File php7-CVE-2026-7258.patch of Package php7

From a38418777f65780d9d622197677e90567690fc07 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Sun, 3 May 2026 20:03:18 +0200
Subject: [PATCH] GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to
 ctype.h functions

Index: php-7.4.33/Zend/zend_compile.c
===================================================================
--- php-7.4.33.orig/Zend/zend_compile.c
+++ php-7.4.33/Zend/zend_compile.c
@@ -1772,7 +1772,7 @@ ZEND_API size_t zend_dirname(char *path,
 	/* Note that on Win32 CWD is per drive (heritage from CP/M).
 	 * This means dirname("c:foo") maps to "c:." or "c:" - which means CWD on C: drive.
 	 */
-	if ((2 <= len) && isalpha((int)((unsigned char *)path)[0]) && (':' == path[1])) {
+	if ((2 <= len) && isalpha((unsigned char)path[0]) && (':' == path[1])) {
 		/* Skip over the drive spec (if any) so as not to change */
 		path += 2;
 		len_adjust += 2;
Index: php-7.4.33/Zend/zend_operators.c
===================================================================
--- php-7.4.33.orig/Zend/zend_operators.c
+++ php-7.4.33/Zend/zend_operators.c
@@ -2804,8 +2804,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_s
 
 	len = MIN(len1, len2);
 	while (len--) {
-		c1 = zend_tolower((int)*(unsigned char *)s1++);
-		c2 = zend_tolower((int)*(unsigned char *)s2++);
+		c1 = zend_tolower((unsigned char)*(s1++));
+		c2 = zend_tolower((unsigned char)*(s2++));
 		if (c1 != c2) {
 			return c1 - c2;
 		}
@@ -2825,8 +2825,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_s
 	}
 	len = MIN(length, MIN(len1, len2));
 	while (len--) {
-		c1 = zend_tolower((int)*(unsigned char *)s1++);
-		c2 = zend_tolower((int)*(unsigned char *)s2++);
+		c1 = zend_tolower((unsigned char)*(s1++));
+		c2 = zend_tolower((unsigned char)*(s2++));
 		if (c1 != c2) {
 			return c1 - c2;
 		}
Index: php-7.4.33/Zend/zend_virtual_cwd.c
===================================================================
--- php-7.4.33.orig/Zend/zend_virtual_cwd.c
+++ php-7.4.33/Zend/zend_virtual_cwd.c
@@ -201,7 +201,7 @@ void virtual_cwd_main_cwd_init(uint8_t r
 	main_cwd_state.cwd_length = strlen(cwd);
 #ifdef ZEND_WIN32
 	if (main_cwd_state.cwd_length >= 2 && cwd[1] == ':') {
-		cwd[0] = toupper(cwd[0]);
+		cwd[0] = toupper((unsigned char)cwd[0]);
 	}
 #endif
 	main_cwd_state.cwd = strdup(cwd);
@@ -279,7 +279,7 @@ CWD_API char *virtual_getcwd_ex(size_t *
 		*length = state->cwd_length+1;
 		retval = (char *) emalloc(*length+1);
 		memcpy(retval, state->cwd, *length);
-		retval[0] = toupper(retval[0]);
+		retval[0] = toupper((unsigned char)retval[0]);
 		retval[*length-1] = DEFAULT_SLASH;
 		retval[*length] = '\0';
 		return retval;
@@ -1120,7 +1120,7 @@ CWD_API int virtual_file_ex(cwd_state *s
 			if (resolved_path[start] == 0) {
 				goto verify;
 			}
-			resolved_path[start] = toupper(resolved_path[start]);
+			resolved_path[start] = toupper((unsigned char)resolved_path[start]);
 			start++;
 		}
 		resolved_path[start++] = DEFAULT_SLASH;
@@ -1128,13 +1128,13 @@ CWD_API int virtual_file_ex(cwd_state *s
 			if (resolved_path[start] == 0) {
 				goto verify;
 			}
-			resolved_path[start] = toupper(resolved_path[start]);
+			resolved_path[start] = toupper((unsigned char)resolved_path[start]);
 			start++;
 		}
 		resolved_path[start++] = DEFAULT_SLASH;
 	} else if (IS_ABSOLUTE_PATH(resolved_path, path_length)) {
 		/* skip DRIVE name */
-		resolved_path[0] = toupper(resolved_path[0]);
+		resolved_path[0] = toupper((unsigned char)resolved_path[0]);
 		resolved_path[2] = DEFAULT_SLASH;
 		start = 3;
 	}
Index: php-7.4.33/Zend/zend_virtual_cwd.h
===================================================================
--- php-7.4.33.orig/Zend/zend_virtual_cwd.h
+++ php-7.4.33/Zend/zend_virtual_cwd.h
@@ -84,7 +84,7 @@ typedef unsigned short mode_t;
 #define IS_UNC_PATH(path, len) \
 	(len >= 2 && IS_SLASH(path[0]) && IS_SLASH(path[1]))
 #define IS_ABSOLUTE_PATH(path, len) \
-	(len >= 2 && (/* is local */isalpha(path[0]) && path[1] == ':' || /* is UNC */IS_SLASH(path[0]) && IS_SLASH(path[1])))
+	(len >= 2 && (/* is local */isalpha((unsigned char)(path)[0]) && path[1] == ':' || /* is UNC */IS_SLASH(path[0]) && IS_SLASH(path[1])))
 
 #else
 #ifdef HAVE_DIRENT_H
Index: php-7.4.33/ext/com_dotnet/com_extension.c
===================================================================
--- php-7.4.33.orig/ext/com_dotnet/com_extension.c
+++ php-7.4.33/ext/com_dotnet/com_extension.c
@@ -241,11 +241,11 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
 		}
 
 		/* Remove leading/training white spaces on search_string */
-		while (isspace(*typelib_name)) {/* Ends on '\0' in worst case */
+		while (isspace((unsigned char)*typelib_name)) {/* Ends on '\0' in worst case */
 			typelib_name ++;
 		}
 		ptr = typelib_name + strlen(typelib_name) - 1;
-		while ((ptr != typelib_name) && isspace(*ptr)) {
+		while ((ptr != typelib_name) && isspace((unsigned char)*ptr)) {
 			*ptr = '\0';
 			ptr--;
 		}
Index: php-7.4.33/ext/date/lib/parse_date.re
===================================================================
--- php-7.4.33.orig/ext/date/lib/parse_date.re
+++ php-7.4.33/ext/date/lib/parse_date.re
@@ -477,7 +477,7 @@ static timelib_sll timelib_get_nr(char *
 
 static void timelib_skip_day_suffix(char **ptr)
 {
-	if (isspace(**ptr)) {
+	if (isspace((unsigned char)**ptr)) {
 		return;
 	}
 	if (!timelib_strncasecmp(*ptr, "nd", 2) || !timelib_strncasecmp(*ptr, "rd", 2) ||!timelib_strncasecmp(*ptr, "st", 2) || !timelib_strncasecmp(*ptr, "th", 2)) {
@@ -742,7 +742,7 @@ static timelib_long timelib_parse_tz_cor
 	char *begin = *ptr, *end;
 	timelib_long  tmp;
 
-	while (isdigit(**ptr) || **ptr == ':') {
+	while (isdigit((unsigned char)**ptr) || **ptr == ':') {
 		++*ptr;
 	}
 	end = *ptr;
@@ -784,7 +784,7 @@ static timelib_long timelib_parse_tz_min
 	}
 
 	++*ptr;
-	while (isdigit(**ptr)) {
+	while (isdigit((unsigned char)**ptr)) {
 		++*ptr;
 	}
 
@@ -1837,10 +1837,10 @@ timelib_time* timelib_strtotime(char *s,
 	in.errors->error_messages = NULL;
 
 	if (len > 0) {
-		while (isspace(*s) && s < e) {
+		while (isspace((unsigned char)*s) && s < e) {
 			s++;
 		}
-		while (isspace(*e) && e > s) {
+		while (isspace((unsigned char)*e) && e > s) {
 			e--;
 		}
 	}
Index: php-7.4.33/ext/date/lib/parse_iso_intervals.re
===================================================================
--- php-7.4.33.orig/ext/date/lib/parse_iso_intervals.re
+++ php-7.4.33/ext/date/lib/parse_iso_intervals.re
@@ -341,10 +341,10 @@ void timelib_strtointerval(char *s, size
 	in.errors->error_messages = NULL;
 
 	if (len > 0) {
-		while (isspace(*s) && s < e) {
+		while (isspace((unsigned char)*s) && s < e) {
 			s++;
 		}
-		while (isspace(*e) && e > s) {
+		while (isspace((unsigned char)*e) && e > s) {
 			e--;
 		}
 	}
Index: php-7.4.33/ext/date/lib/timelib.c
===================================================================
--- php-7.4.33.orig/ext/date/lib/timelib.c
+++ php-7.4.33/ext/date/lib/timelib.c
@@ -123,7 +123,7 @@ void timelib_time_tz_abbr_update(timelib
 	TIMELIB_TIME_FREE(tm->tz_abbr);
 	tm->tz_abbr = timelib_strdup(tz_abbr);
 	for (i = 0; i < tz_abbr_len; i++) {
-		tm->tz_abbr[i] = toupper(tz_abbr[i]);
+		tm->tz_abbr[i] = toupper((unsigned char)tz_abbr[i]);
 	}
 }
 
Index: php-7.4.33/ext/filter/logical_filters.c
===================================================================
--- php-7.4.33.orig/ext/filter/logical_filters.c
+++ php-7.4.33/ext/filter/logical_filters.c
@@ -519,21 +519,21 @@ static int _php_filter_validate_domain(c
 	}
 
 	/* First char must be alphanumeric */
-	if(*s == '.' || (hostname && !isalnum((int)*(unsigned char *)s))) {
+	if(*s == '.' || (hostname && !isalnum((unsigned char)*s))) {
 		return 0;
 	}
 
 	while (s < e) {
 		if (*s == '.') {
 			/* The first and the last character of a label must be alphanumeric */
-			if (*(s + 1) == '.' || (hostname && (!isalnum((int)*(unsigned char *)(s - 1)) || !isalnum((int)*(unsigned char *)(s + 1))))) {
+			if (*(s + 1) == '.' || (hostname && (!isalnum((unsigned char)s[-1]) || !isalnum((unsigned char)s[1])))) {
 				return 0;
 			}
 
 			/* Reset label length counter */
 			i = 1;
 		} else {
-			if (i > 63 || (hostname && *s != '-' && !isalnum((int)*(unsigned char *)s))) {
+			if (i > 63 || (hostname && *s != '-' && !isalnum((unsigned char)*s))) {
 				return 0;
 			}
 
@@ -560,9 +560,9 @@ static int is_userinfo_valid(zend_string
 	const char *valid = "-._~!$&'()*+,;=:";
 	const char *p = ZSTR_VAL(str);
 	while (p - ZSTR_VAL(str) < ZSTR_LEN(str)) {
-		if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
+		if (isalpha((unsigned char)*p) || isdigit((unsigned char)*p) || strchr(valid, *p)) {
 			p++;
-		} else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
+		} else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit((unsigned char)p[1]) && isxdigit((unsigned char)p[2])) {
 			p += 3;
 		} else {
 			return 0;
Index: php-7.4.33/ext/ftp/ftp.c
===================================================================
--- php-7.4.33.orig/ext/ftp/ftp.c
+++ php-7.4.33/ext/ftp/ftp.c
@@ -513,7 +513,7 @@ ftp_raw(ftpbuf_t *ftp, const char *cmd,
 	array_init(return_value);
 	while (ftp_readline(ftp)) {
 		add_next_index_string(return_value, ftp->inbuf);
-		if (isdigit(ftp->inbuf[0]) && isdigit(ftp->inbuf[1]) && isdigit(ftp->inbuf[2]) && ftp->inbuf[3] == ' ') {
+		if (isdigit((unsigned char)ftp->inbuf[0]) && isdigit((unsigned char)ftp->inbuf[1]) && isdigit((unsigned char)ftp->inbuf[2]) && ftp->inbuf[3] == ' ') {
 			return;
 		}
 	}
@@ -867,7 +867,7 @@ ftp_pasv(ftpbuf_t *ftp, int pasv)
 		return 0;
 	}
 	/* parse out the IP and port */
-	for (ptr = ftp->inbuf; *ptr && !isdigit(*ptr); ptr++);
+	for (ptr = ftp->inbuf; *ptr && !isdigit((unsigned char)*ptr); ptr++);
 	n = sscanf(ptr, "%lu,%lu,%lu,%lu,%lu,%lu", &b[0], &b[1], &b[2], &b[3], &b[4], &b[5]);
 	if (n != 6) {
 		return 0;
@@ -1178,7 +1178,7 @@ ftp_mdtm(ftpbuf_t *ftp, const char *path
 		return -1;
 	}
 	/* parse out the timestamp */
-	for (ptr = ftp->inbuf; *ptr && !isdigit(*ptr); ptr++);
+	for (ptr = ftp->inbuf; *ptr && !isdigit((unsigned char)*ptr); ptr++);
 	n = sscanf(ptr, "%4u%2u%2u%2u%2u%2u", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec);
 	if (n != 6) {
 		return -1;
@@ -1382,13 +1382,13 @@ ftp_getresp(ftpbuf_t *ftp)
 		}
 
 		/* Break out when the end-tag is found */
-		if (isdigit(ftp->inbuf[0]) && isdigit(ftp->inbuf[1]) && isdigit(ftp->inbuf[2]) && ftp->inbuf[3] == ' ') {
+		if (isdigit((unsigned char)ftp->inbuf[0]) && isdigit((unsigned char)ftp->inbuf[1]) && isdigit((unsigned char)ftp->inbuf[2]) && ftp->inbuf[3] == ' ') {
 			break;
 		}
 	}
 
 	/* translate the tag */
-	if (!isdigit(ftp->inbuf[0]) || !isdigit(ftp->inbuf[1]) || !isdigit(ftp->inbuf[2])) {
+	if (!isdigit((unsigned char)ftp->inbuf[0]) || !isdigit((unsigned char)ftp->inbuf[1]) || !isdigit((unsigned char)ftp->inbuf[2])) {
 		return 0;
 	}
 
Index: php-7.4.33/ext/gd/libgd/gd_xbm.c
===================================================================
--- php-7.4.33.orig/ext/gd/libgd/gd_xbm.c
+++ php-7.4.33/ext/gd/libgd/gd_xbm.c
@@ -193,7 +193,7 @@ void gdImageXbmCtx(gdImagePtr image, cha
 	} else {
 		for (i=0; i<l; i++) {
 			/* only in C-locale isalnum() would work */
-			if (!isupper(name[i]) && !islower(name[i]) && !isdigit(name[i])) {
+			if (!isupper((unsigned char)name[i]) && !islower((unsigned char)name[i]) && !isdigit((unsigned char)name[i])) {
 				name[i] = '_';
 			}
 		}
Index: php-7.4.33/ext/imap/php_imap.c
===================================================================
--- php-7.4.33.orig/ext/imap/php_imap.c
+++ php-7.4.33/ext/imap/php_imap.c
@@ -2808,7 +2808,7 @@ PHP_FUNCTION(imap_utf8)
 #define SPECIAL(c) ((c) <= 0x1f || (c) >= 0x7f)
 
 /* validate a modified-base64 character */
-#define B64CHAR(c) (isalnum(c) || (c) == '+' || (c) == ',')
+#define B64CHAR(c) (isalnum((unsigned char)(c)) || (c) == '+' || (c) == ',')
 
 /* map the low 64 bits of `n' to the modified-base64 characters */
 #define B64(n)	("ABCDEFGHIJKLMNOPQRSTUVWXYZ" \
Index: php-7.4.33/ext/intl/locale/locale_methods.c
===================================================================
--- php-7.4.33.orig/ext/intl/locale/locale_methods.c
+++ php-7.4.33/ext/intl/locale/locale_methods.c
@@ -1216,7 +1216,7 @@ static int strToMatch(const char* str ,c
 		if( *str == '-' ){
 			*retstr =  '_';
 		} else {
-			*retstr = tolower(*str);
+			*retstr = tolower((unsigned char)*str);
 		}
             str++;
             retstr++;
Index: php-7.4.33/ext/mbstring/mbstring.c
===================================================================
--- php-7.4.33.orig/ext/mbstring/mbstring.c
+++ php-7.4.33/ext/mbstring/mbstring.c
@@ -1176,7 +1176,7 @@ static char *php_mb_rfc1867_getword(cons
 
 static char *php_mb_rfc1867_getword_conf(const zend_encoding *encoding, char *str) /* {{{ */
 {
-	while (*str && isspace(*(unsigned char *)str)) {
+	while (*str && isspace((unsigned char)*str)) {
 		++str;
 	}
 
@@ -1192,7 +1192,7 @@ static char *php_mb_rfc1867_getword_conf
 	} else {
 		char *strend = str;
 
-		while (*strend && !isspace(*(unsigned char *)strend)) {
+		while (*strend && !isspace((unsigned char)*strend)) {
 			++strend;
 		}
 		return php_mb_rfc1867_substring_conf(encoding, str, strend - str, 0);
Index: php-7.4.33/ext/mbstring/php_mbregex.c
===================================================================
--- php-7.4.33.orig/ext/mbstring/php_mbregex.c
+++ php-7.4.33/ext/mbstring/php_mbregex.c
@@ -777,7 +777,7 @@ static inline void mb_regex_substitute(
 						continue;
 					}
 					if (name_end[0] == delim) break;
-					if (maybe_num && !isdigit(name_end[0])) maybe_num = 0;
+					if (maybe_num && !isdigit((unsigned char)name_end[0])) maybe_num = 0;
 					name_end++;
 				}
 				p = name_end + 1;
Index: php-7.4.33/ext/pcre/php_pcre.c
===================================================================
--- php-7.4.33.orig/ext/pcre/php_pcre.c
+++ php-7.4.33/ext/pcre/php_pcre.c
@@ -622,7 +622,7 @@ PHPAPI pcre_cache_entry* pcre_get_compil
 
 	/* Parse through the leading whitespace, and display a warning if we
 	   get to the end without encountering a delimiter. */
-	while (isspace((int)*(unsigned char *)p)) p++;
+	while (isspace((unsigned char)*p)) p++;
 	if (*p == 0) {
 		if (key != regex) {
 			zend_string_release_ex(key, 0);
@@ -636,7 +636,7 @@ PHPAPI pcre_cache_entry* pcre_get_compil
 	/* Get the delimiter and display a warning if it is alphanumeric
 	   or a backslash. */
 	delimiter = *p++;
-	if (isalnum((int)*(unsigned char *)&delimiter) || delimiter == '\\') {
+	if (isalnum((unsigned char)delimiter) || delimiter == '\\') {
 		if (key != regex) {
 			zend_string_release_ex(key, 0);
 		}
Index: php-7.4.33/ext/pdo/pdo.c
===================================================================
--- php-7.4.33.orig/ext/pdo/pdo.c
+++ php-7.4.33/ext/pdo/pdo.c
@@ -262,7 +262,7 @@ PDO_API int php_pdo_parse_data_source(co
 			}
 		}
 
-		while (i < data_source_len && isspace(data_source[i])) {
+		while (i < data_source_len && isspace((unsigned char)data_source[i])) {
 			i++;
 		}
 
Index: php-7.4.33/ext/pdo/pdo_sql_parser.re
===================================================================
--- php-7.4.33.orig/ext/pdo/pdo_sql_parser.re
+++ php-7.4.33/ext/pdo/pdo_sql_parser.re
@@ -111,7 +111,7 @@ PDO_API int pdo_parse_params(pdo_stmt_t
 
 			if (t == PDO_PARSER_BIND) {
 				ptrdiff_t len = s.cur - s.tok;
-				if ((inquery < (s.cur - len)) && isalnum(*(s.cur - len - 1))) {
+				if ((inquery < (s.cur - len)) && isalnum((unsigned char)s.cur[-len - 1])) {
 					continue;
 				}
 				query_type |= PDO_PLACEHOLDER_NAMED;
Index: php-7.4.33/ext/pdo/pdo_stmt.c
===================================================================
--- php-7.4.33.orig/ext/pdo/pdo_stmt.c
+++ php-7.4.33/ext/pdo/pdo_stmt.c
@@ -210,7 +210,7 @@ int pdo_stmt_describe_columns(pdo_stmt_t
 			switch (stmt->dbh->desired_case) {
 				case PDO_CASE_UPPER:
 					while (*s != '\0') {
-						*s = toupper(*s);
+						*s = toupper((unsigned char)*s);
 						s++;
 					}
 					break;
Index: php-7.4.33/ext/standard/dl.c
===================================================================
--- php-7.4.33.orig/ext/standard/dl.c
+++ php-7.4.33/ext/standard/dl.c
@@ -85,7 +85,7 @@ PHPAPI void *php_load_shlib(char *path,
 			size_t i = strlen(err);
 			(*errp)=estrdup(err);
 			php_win32_error_msg_free(err);
-			while (i > 0 && isspace((*errp)[i-1])) { (*errp)[i-1] = '\0'; i--; }
+			while (i > 0 && isspace((unsigned char)(*errp)[i-1])) { (*errp)[i-1] = '\0'; i--; }
 		} else {
 			(*errp) = estrdup("<No message>");
 		}
Index: php-7.4.33/ext/standard/file.c
===================================================================
--- php-7.4.33.orig/ext/standard/file.c
+++ php-7.4.33/ext/standard/file.c
@@ -2118,7 +2118,7 @@ PHPAPI void php_fgetcsv(php_stream *stre
 		inc_len = (bptr < limit ? (*bptr == '\0' ? 1 : php_mblen(bptr, limit - bptr)): 0);
 		if (inc_len == 1) {
 			char *tmp = bptr;
-			while ((*tmp != delimiter) && isspace((int)*(unsigned char *)tmp)) {
+			while ((*tmp != delimiter) && isspace((unsigned char)*tmp)) {
 				tmp++;
   			}
 			if (*tmp == enclosure) {
Index: php-7.4.33/ext/standard/filters.c
===================================================================
--- php-7.4.33.orig/ext/standard/filters.c
+++ php-7.4.33/ext/standard/filters.c
@@ -1090,7 +1090,7 @@ static php_conv_err_t php_conv_qprint_de
 					goto out;
 				}
 
-				if (!isxdigit((int) *ps)) {
+				if (!isxdigit(*ps)) {
 					err = PHP_CONV_ERR_INVALID_SEQ;
 					goto out;
 				}
Index: php-7.4.33/ext/standard/formatted_print.c
===================================================================
--- php-7.4.33.orig/ext/standard/formatted_print.c
+++ php-7.4.33/ext/standard/formatted_print.c
@@ -440,13 +440,13 @@ php_formatted_print(zval *z_format, zval
 
 			PRINTF_DEBUG(("sprintf: first looking at '%c', inpos=%d\n",
 						  *format, format - Z_STRVAL_P(z_format)));
-			if (isalpha((int)*format)) {
+			if (isalpha((unsigned char)*format)) {
 				width = precision = 0;
 				argnum = currarg++;
 			} else {
 				/* first look for argnum */
 				temppos = format;
-				while (isdigit((int)*temppos)) temppos++;
+				while (isdigit((unsigned char)*temppos)) temppos++;
 				if (*temppos == '$') {
 					argnum = php_sprintf_getnumber(&format, &format_len);
 
@@ -489,7 +489,7 @@ php_formatted_print(zval *z_format, zval
 
 
 				/* after modifiers comes width */
-				if (isdigit((int)*format)) {
+				if (isdigit((unsigned char)*format)) {
 					PRINTF_DEBUG(("sprintf: getting width\n"));
 					if ((width = php_sprintf_getnumber(&format, &format_len)) < 0) {
 						efree(result);
@@ -507,7 +507,7 @@ php_formatted_print(zval *z_format, zval
 					format++;
 					format_len--;
 					PRINTF_DEBUG(("sprintf: getting precision\n"));
-					if (isdigit((int)*format)) {
+					if (isdigit((unsigned char)*format)) {
 						if ((precision = php_sprintf_getnumber(&format, &format_len)) < 0) {
 							efree(result);
 							php_error_docref(NULL, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);
Index: php-7.4.33/ext/standard/ftp_fopen_wrapper.c
===================================================================
--- php-7.4.33.orig/ext/standard/ftp_fopen_wrapper.c
+++ php-7.4.33/ext/standard/ftp_fopen_wrapper.c
@@ -81,8 +81,8 @@ static inline int get_ftp_result(php_str
 {
 	buffer[0] = '\0'; /* in case read fails to read anything */
 	while (php_stream_gets(stream, buffer, buffer_size-1) &&
-		   !(isdigit((int) buffer[0]) && isdigit((int) buffer[1]) &&
-			 isdigit((int) buffer[2]) && buffer[3] == ' '));
+		   !(isdigit((unsigned char)buffer[0]) && isdigit((unsigned char)buffer[1]) &&
+			 isdigit((unsigned char)buffer[2]) && buffer[3] == ' '));
 	return strtol(buffer, NULL, 10);
 }
 /* }}} */
@@ -234,7 +234,7 @@ static php_stream *php_ftp_fopen_connect
 #define PHP_FTP_CNTRL_CHK(val, val_len, err_msg) {	\
 	unsigned char *s = (unsigned char *) val, *e = (unsigned char *) s + val_len;	\
 	while (s < e) {	\
-		if (iscntrl(*s)) {	\
+		if (iscntrl((unsigned char)*s)) {	\
 			php_stream_wrapper_log_error(wrapper, options, err_msg, val);	\
 			goto connect_errexit;	\
 		}	\
@@ -346,14 +346,14 @@ static unsigned short php_fopen_do_pasv(
 		/* parse pasv command (129, 80, 95, 25, 13, 221) */
 		tpath = tmp_line;
 		/* skip over the "227 Some message " part */
-		for (tpath += 4; *tpath && !isdigit((int) *tpath); tpath++);
+		for (tpath += 4; *tpath && !isdigit((unsigned char)*tpath); tpath++);
 		if (!*tpath) {
 			return 0;
 		}
 		/* skip over the host ip, to get the port */
 		hoststart = tpath;
 		for (i = 0; i < 4; i++) {
-			for (; isdigit((int) *tpath); tpath++);
+			for (; isdigit((unsigned char)*tpath); tpath++);
 			if (*tpath != ',') {
 				return 0;
 			}
@@ -838,7 +838,7 @@ static int php_stream_ftp_url_stat(php_s
 		struct tm tm, tmbuf, *gmt;
 		time_t stamp;
 
-		while ((size_t)(p - tmp_line) < sizeof(tmp_line) && !isdigit(*p)) {
+		while ((size_t)(p - tmp_line) < sizeof(tmp_line) && !isdigit((unsigned char)*p)) {
 			p++;
 		}
 
Index: php-7.4.33/ext/standard/html.c
===================================================================
--- php-7.4.33.orig/ext/standard/html.c
+++ php-7.4.33/ext/standard/html.c
@@ -753,8 +753,8 @@ static inline int process_numeric_entity
 
 	/* strtol allows whitespace and other stuff in the beginning
 		* we're not interested */
-	if ((hexadecimal && !isxdigit(**buf)) ||
-			(!hexadecimal && !isdigit(**buf))) {
+	if ((hexadecimal && !isxdigit((unsigned char)**buf)) ||
+			(!hexadecimal && !isdigit((unsigned char)**buf))) {
 		return FAILURE;
 	}
 
Index: php-7.4.33/ext/standard/math.c
===================================================================
--- php-7.4.33.orig/ext/standard/math.c
+++ php-7.4.33/ext/standard/math.c
@@ -863,9 +863,9 @@ PHPAPI int _php_math_basetozval(zval *ar
 	e = s + Z_STRLEN_P(arg);
 
 	/* Skip leading whitespace */
-	while (s < e && isspace(*s)) s++;
+	while (s < e && isspace((unsigned char)*s)) s++;
 	/* Skip trailing whitespace */
-	while (s < e && isspace(*(e-1))) e--;
+	while (s < e && isspace((unsigned char)e[-1])) e--;
 
 	if (e - s >= 2) {
 		if (base == 16 && s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) s += 2;
@@ -1160,7 +1160,7 @@ PHPAPI zend_string *_php_math_number_for
 	tmpbuf = strpprintf(0, "%.*F", dec, d);
 	if (tmpbuf == NULL) {
 		return NULL;
-	} else if (!isdigit((int)ZSTR_VAL(tmpbuf)[0])) {
+	} else if (!isdigit((unsigned char)ZSTR_VAL(tmpbuf)[0])) {
 		return tmpbuf;
 	}
 
Index: php-7.4.33/ext/standard/metaphone.c
===================================================================
--- php-7.4.33.orig/ext/standard/metaphone.c
+++ php-7.4.33/ext/standard/metaphone.c
@@ -83,7 +83,7 @@ static const char _codes[26] =
 };
 
 
-#define ENCODE(c) (isalpha(c) ? _codes[((toupper(c)) - 'A')] : 0)
+#define ENCODE(c) (isalpha((unsigned char)(c)) ? _codes[((toupper((unsigned char)(c))) - 'A')] : 0)
 
 #define isvowel(c)  (ENCODE(c) & 1)		/* AEIOU */
 
@@ -107,17 +107,17 @@ static const char _codes[26] =
  * accesssing the array directly... */
 
 /* Look at the next letter in the word */
-#define Next_Letter (toupper(word[w_idx+1]))
+#define Next_Letter (toupper((unsigned char)word[w_idx+1]))
 /* Look at the current letter in the word */
-#define Curr_Letter (toupper(word[w_idx]))
+#define Curr_Letter (toupper((unsigned char)word[w_idx]))
 /* Go N letters back. */
-#define Look_Back_Letter(n)	(w_idx >= n ? toupper(word[w_idx-n]) : '\0')
+#define Look_Back_Letter(n)	(w_idx >= n ? toupper((unsigned char)word[w_idx-n]) : '\0')
 /* Previous letter.  I dunno, should this return null on failure? */
 #define Prev_Letter (Look_Back_Letter(1))
 /* Look two letters down.  It makes sure you don't walk off the string. */
-#define After_Next_Letter	(Next_Letter != '\0' ? toupper(word[w_idx+2]) \
+#define After_Next_Letter	(Next_Letter != '\0' ? toupper((unsigned char)word[w_idx+2]) \
 											     : '\0')
-#define Look_Ahead_Letter(n) (toupper(Lookahead((char *) word+w_idx, n)))
+#define Look_Ahead_Letter(n) (toupper((unsigned char)Lookahead((char *) word+w_idx, n)))
 
 
 /* Allows us to safely look ahead an arbitrary # of letters */
@@ -161,7 +161,7 @@ static char Lookahead(char *word, size_t
 #define Phone_Len	(p_idx)
 
 /* Note is a letter is a 'break' in the word */
-#define Isbreak(c)  (!isalpha(c))
+#define Isbreak(c)  (!isalpha((unsigned char)(c)))
 
 /* {{{ metaphone
  */
@@ -196,7 +196,7 @@ static int metaphone(unsigned char *word
 
 /*-- The first phoneme has to be processed specially. --*/
 	/* Find our first letter */
-	for (; !isalpha(Curr_Letter); w_idx++) {
+	for (; !isalpha((unsigned char)Curr_Letter); w_idx++) {
 		/* On the off chance we were given nothing but crap... */
 		if (Curr_Letter == '\0') {
 			End_Phoned_Word
@@ -280,7 +280,7 @@ static int metaphone(unsigned char *word
 		 */
 
 		/* Ignore non-alphas */
-		if (!isalpha(Curr_Letter))
+		if (!isalpha((unsigned char)Curr_Letter))
 			continue;
 
 		/* Drop duplicates, except CC */
Index: php-7.4.33/ext/standard/quot_print.c
===================================================================
--- php-7.4.33.orig/ext/standard/quot_print.c
+++ php-7.4.33/ext/standard/quot_print.c
@@ -219,11 +219,11 @@ PHP_FUNCTION(quoted_printable_decode)
 		switch (str_in[i]) {
 		case '=':
 			if (str_in[i + 1] && str_in[i + 2] &&
-				isxdigit((int) str_in[i + 1]) &&
-				isxdigit((int) str_in[i + 2]))
+				isxdigit((unsigned char)str_in[i + 1]) &&
+				isxdigit((unsigned char)str_in[i + 2]))
 			{
-				ZSTR_VAL(str_out)[j++] = (php_hex2int((int) str_in[i + 1]) << 4)
-						+ php_hex2int((int) str_in[i + 2]);
+				ZSTR_VAL(str_out)[j++] = (php_hex2int((unsigned char)str_in[i + 1]) << 4)
+						+ php_hex2int((unsigned char)str_in[i + 2]);
 				i += 3;
 			} else  /* check for soft line break according to RFC 2045*/ {
 				k = 1;
Index: php-7.4.33/ext/standard/scanf.c
===================================================================
--- php-7.4.33.orig/ext/standard/scanf.c
+++ php-7.4.33/ext/standard/scanf.c
@@ -345,7 +345,7 @@ PHPAPI int ValidateFormat(char *format,
 			goto xpgCheckDone;
 		}
 
-		if ( isdigit( (int)*ch ) ) {
+		if ( isdigit( (unsigned char)*ch ) ) {
 			/*
 			 * Check for an XPG3-style %n$ specification.  Note: there
 			 * must not be a mixture of XPG3 specs and non-XPG3 specs
@@ -664,9 +664,9 @@ PHPAPI int php_sscanf_internal( char *st
 		/*
 		 * If we see whitespace in the format, skip whitespace in the string.
 		 */
-		if ( isspace( (int)*ch ) ) {
+		if ( isspace( (unsigned char)*ch ) ) {
 			sch = *string;
-			while ( isspace( (int)sch ) ) {
+			while ( isspace( (unsigned char)sch ) ) {
 				if (*string == '\0') {
 					goto done;
 				}
@@ -817,7 +817,7 @@ literal:
 		if (!(flags & SCAN_NOSKIP)) {
 			while (*string != '\0') {
 				sch = *string;
-				if (! isspace((int)sch) ) {
+				if (! isspace((unsigned char)sch) ) {
 					break;
 				}
 				string++;
@@ -843,7 +843,7 @@ literal:
 				end = string;
 				while (*end != '\0') {
 					sch = *end;
-					if ( isspace( (int)sch ) ) {
+					if ( isspace( (unsigned char)sch ) ) {
 						break;
 					}
 					end++;
Index: php-7.4.33/ext/standard/soundex.c
===================================================================
--- php-7.4.33.orig/ext/standard/soundex.c
+++ php-7.4.33/ext/standard/soundex.c
@@ -74,7 +74,7 @@ PHP_FUNCTION(soundex)
 		/* BUG: should also map here accented letters used in non */
 		/* English words or names (also found in English text!): */
 		/* esstsett, thorn, n-tilde, c-cedilla, s-caron, ... */
-		code = toupper((int)(unsigned char)str[i]);
+		code = toupper((unsigned char)str[i]);
 		if (code >= 'A' && code <= 'Z') {
 			if (_small == 0) {
 				/* remember first valid char */
Index: php-7.4.33/ext/standard/string.c
===================================================================
--- php-7.4.33.orig/ext/standard/string.c
+++ php-7.4.33/ext/standard/string.c
@@ -3773,9 +3773,9 @@ PHPAPI void php_stripcslashes(zend_strin
 				case 'f':  *target++='\f'; nlen--; break;
 				case '\\': *target++='\\'; nlen--; break;
 				case 'x':
-					if (source+1 < end && isxdigit((int)(*(source+1)))) {
+					if (source+1 < end && isxdigit((unsigned char)source[1])) {
 						numtmp[0] = *++source;
-						if (source+1 < end && isxdigit((int)(*(source+1)))) {
+						if (source+1 < end && isxdigit((unsigned char)source[1])) {
 							numtmp[1] = *++source;
 							numtmp[2] = '\0';
 							nlen-=3;
@@ -4636,7 +4636,7 @@ static void php_hebrev(INTERNAL_FUNCTION
 
 	do {
 		if (block_type == _HEB_BLOCK_TYPE_HEB) {
-			while ((isheb((int)*(tmp+1)) || _isblank((int)*(tmp+1)) || ispunct((int)*(tmp+1)) || (int)*(tmp+1)=='\n' ) && block_end<str_len-1) {
+			while ((isheb((int)*(tmp+1)) || _isblank((int)*(tmp+1)) || ispunct((unsigned char)tmp[1]) || (int)*(tmp+1)=='\n' ) && block_end<str_len-1) {
 				tmp++;
 				block_end++;
 				block_length++;
@@ -4686,7 +4686,7 @@ static void php_hebrev(INTERNAL_FUNCTION
 				block_end++;
 				block_length++;
 			}
-			while ((_isblank((int)*tmp) || ispunct((int)*tmp)) && *tmp!='/' && *tmp!='-' && block_end > block_start) {
+			while ((_isblank((int)*tmp) || ispunct((unsigned char)*tmp)) && *tmp!='/' && *tmp!='-' && block_end > block_start) {
 				tmp--;
 				block_end--;
 			}
@@ -5113,7 +5113,7 @@ int php_tag_find(char *tag, size_t len,
 				done =1;
 				break;
 			default:
-				if (!isspace((int)c)) {
+				if (!isspace((unsigned char)c)) {
 					if (state == 0) {
 						state=1;
 					}
@@ -5215,7 +5215,7 @@ state_0:
 			if (in_q) {
 				break;
 			}
-			if (isspace(*(p + 1)) && !allow_tag_spaces) {
+			if (isspace((unsigned char)p[1]) && !allow_tag_spaces) {
 				*(rp++) = c;
 				break;
 			}
@@ -5262,7 +5262,7 @@ state_1:
 			if (in_q) {
 				break;
 			}
-			if (isspace(*(p + 1)) && !allow_tag_spaces) {
+			if (isspace((unsigned char)p[1]) && !allow_tag_spaces) {
 				goto reg_char_1;
 			}
 			depth++;
Index: php-7.4.33/ext/standard/strnatcmp.c
===================================================================
--- php-7.4.33.orig/ext/standard/strnatcmp.c
+++ php-7.4.33/ext/standard/strnatcmp.c
@@ -41,12 +41,12 @@ compare_right(char const **a, char const
 	   both numbers to know that they have the same magnitude, so we
 	   remember it in BIAS. */
 	for(;; (*a)++, (*b)++) {
-		if ((*a == aend || !isdigit((int)(unsigned char)**a)) &&
-			(*b == bend || !isdigit((int)(unsigned char)**b)))
+		if ((*a == aend || !isdigit((unsigned char)**a)) &&
+			(*b == bend || !isdigit((unsigned char)**b)))
 			return bias;
-		else if (*a == aend || !isdigit((int)(unsigned char)**a))
+		else if (*a == aend || !isdigit((unsigned char)**a))
 			return -1;
-		else if (*b == bend || !isdigit((int)(unsigned char)**b))
+		else if (*b == bend || !isdigit((unsigned char)**b))
 			return +1;
 		else if (**a < **b) {
 			if (!bias)
@@ -69,12 +69,12 @@ compare_left(char const **a, char const
      /* Compare two left-aligned numbers: the first to have a
         different value wins. */
 	for(;; (*a)++, (*b)++) {
-		if ((*a == aend || !isdigit((int)(unsigned char)**a)) &&
-			(*b == bend || !isdigit((int)(unsigned char)**b)))
+		if ((*a == aend || !isdigit((unsigned char)**a)) &&
+			(*b == bend || !isdigit((unsigned char)**b)))
 			return 0;
-		else if (*a == aend || !isdigit((int)(unsigned char)**a))
+		else if (*a == aend || !isdigit((unsigned char)**a))
 			return -1;
-		else if (*b == bend || !isdigit((int)(unsigned char)**b))
+		else if (*b == bend || !isdigit((unsigned char)**b))
 			return +1;
 		 else if (**a < **b)
 			 return -1;
@@ -107,27 +107,27 @@ PHPAPI int strnatcmp_ex(char const *a, s
 		ca = *ap; cb = *bp;
 
 		/* skip over leading zeros */
-		while (leading && ca == '0' && (ap+1 < aend) && isdigit((int)(unsigned char)*(ap+1))) {
+		while (leading && ca == '0' && (ap+1 < aend) && isdigit((unsigned char)ap[1])) {
 			ca = *++ap;
 		}
 
-		while (leading && cb == '0' && (bp+1 < bend) && isdigit((int)(unsigned char)*(bp+1))) {
+		while (leading && cb == '0' && (bp+1 < bend) && isdigit((unsigned char)bp[1])) {
 			cb = *++bp;
 		}
 
 		leading = 0;
 
 		/* Skip consecutive whitespace */
-		while (isspace((int)(unsigned char)ca)) {
+		while (isspace(ca)) {
 			ca = *++ap;
 		}
 
-		while (isspace((int)(unsigned char)cb)) {
+		while (isspace(cb)) {
 			cb = *++bp;
 		}
 
 		/* process run of digits */
-		if (isdigit((int)(unsigned char)ca)  &&  isdigit((int)(unsigned char)cb)) {
+		if (isdigit(ca)  &&  isdigit(cb)) {
 			fractional = (ca == '0' || cb == '0');
 
 			if (fractional)
@@ -151,8 +151,8 @@ PHPAPI int strnatcmp_ex(char const *a, s
 		}
 
 		if (fold_case) {
-			ca = toupper((int)(unsigned char)ca);
-			cb = toupper((int)(unsigned char)cb);
+			ca = toupper(ca);
+			cb = toupper(cb);
 		}
 
 		if (ca < cb)
Index: php-7.4.33/ext/standard/type.c
===================================================================
--- php-7.4.33.orig/ext/standard/type.c
+++ php-7.4.33/ext/standard/type.c
@@ -121,7 +121,7 @@ PHP_FUNCTION(intval)
 		char *strval = Z_STRVAL_P(num);
 		size_t strlen = Z_STRLEN_P(num);
 
-		while (isspace(*strval) && strlen) {
+		while (isspace((unsigned char)*strval) && strlen) {
 			strval++;
 			strlen--;
 		}
Index: php-7.4.33/ext/standard/url.c
===================================================================
--- php-7.4.33.orig/ext/standard/url.c
+++ php-7.4.33/ext/standard/url.c
@@ -124,7 +124,7 @@ PHPAPI php_url *php_url_parse_ex2(char c
 		p = s;
 		while (p < e) {
 			/* scheme = 1*[ lowalpha | digit | "+" | "-" | "." ] */
-			if (!isalpha(*p) && !isdigit(*p) && *p != '+' && *p != '.' && *p != '-') {
+			if (!isalpha((unsigned char)*p) && !isdigit((unsigned char)*p) && *p != '+' && *p != '.' && *p != '-') {
 				if (e + 1 < ue && e < binary_strcspn(s, ue, "?#")) {
 					goto parse_port;
 				} else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
@@ -153,7 +153,7 @@ PHPAPI php_url *php_url_parse_ex2(char c
 			 * correctly parse things like a.com:80
 			 */
 			p = e + 1;
-			while (p < ue && isdigit(*p)) {
+			while (p < ue && isdigit((unsigned char)*p)) {
 				p++;
 			}
 
@@ -193,7 +193,7 @@ PHPAPI php_url *php_url_parse_ex2(char c
 		p = e + 1;
 		pp = p;
 
-		while (pp < ue && pp - p < 6 && isdigit(*pp)) {
+		while (pp < ue && pp - p < 6 && isdigit((unsigned char)*pp)) {
 			pp++;
 		}
 
@@ -434,12 +434,12 @@ static int php_htoi(char *s)
 	int value;
 	int c;
 
-	c = ((unsigned char *)s)[0];
+	c = (unsigned char)s[0];
 	if (isupper(c))
 		c = tolower(c);
 	value = (c >= '0' && c <= '9' ? c - '0' : c - 'a' + 10) * 16;
 
-	c = ((unsigned char *)s)[1];
+	c = (unsigned char)s[1];
 	if (isupper(c))
 		c = tolower(c);
 	value += c >= '0' && c <= '9' ? c - '0' : c - 'a' + 10;
@@ -553,8 +553,8 @@ PHPAPI size_t php_url_decode(char *str,
 		if (*data == '+') {
 			*dest = ' ';
 		}
-		else if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1))
-				 && isxdigit((int) *(data + 2))) {
+		else if (*data == '%' && len >= 2 && isxdigit((unsigned char) *(data + 1))
+				 && isxdigit((unsigned char) *(data + 2))) {
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
@@ -649,8 +649,8 @@ PHPAPI size_t php_raw_url_decode(char *s
 	char *data = str;
 
 	while (len--) {
-		if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1))
-			&& isxdigit((int) *(data + 2))) {
+		if (*data == '%' && len >= 2 && isxdigit((unsigned char) *(data + 1))
+			&& isxdigit((unsigned char) *(data + 2))) {
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
@@ -716,7 +716,7 @@ no_name_header:
 				c = *p;
 				*p = '\0';
 				s = p + 1;
-				while (isspace((int)*(unsigned char *)s)) {
+				while (isspace((unsigned char)*s)) {
 					s++;
 				}
 
Index: php-7.4.33/ext/standard/url_scanner_ex.re
===================================================================
--- php-7.4.33.orig/ext/standard/url_scanner_ex.re
+++ php-7.4.33/ext/standard/url_scanner_ex.re
@@ -87,7 +87,7 @@ static int php_ini_on_update_tags(zend_i
 
 			*val++ = '\0';
 			for (q = key; *q; q++) {
-				*q = tolower(*q);
+				*q = tolower((unsigned char)*q);
 			}
 			keylen = q - key;
 			str = zend_string_init(key, keylen, 1);
@@ -136,7 +136,7 @@ static int php_ini_on_update_hosts(zend_
 		char *q;
 
 		for (q = key; *q; q++) {
-			*q = tolower(*q);
+			*q = tolower((unsigned char)*q);
 		}
 		keylen = q - key;
 		if (keylen > 0) {
@@ -456,7 +456,7 @@ static inline void handle_tag(STD_PARA)
 	}
 	smart_str_appendl(&ctx->tag, start, YYCURSOR - start);
 	for (i = 0; i < ZSTR_LEN(ctx->tag.s); i++)
-		ZSTR_VAL(ctx->tag.s)[i] = tolower((int)(unsigned char)ZSTR_VAL(ctx->tag.s)[i]);
+		ZSTR_VAL(ctx->tag.s)[i] = tolower((unsigned char)ZSTR_VAL(ctx->tag.s)[i]);
     /* intentionally using str_find here, in case the hash value is set, but the string val is changed later */
 	if ((ctx->lookup_data = zend_hash_str_find_ptr(ctx->tags, ZSTR_VAL(ctx->tag.s), ZSTR_LEN(ctx->tag.s))) != NULL) {
 		ok = 1;
Index: php-7.4.33/ext/standard/versioning.c
===================================================================
--- php-7.4.33.orig/ext/standard/versioning.c
+++ php-7.4.33/ext/standard/versioning.c
@@ -47,8 +47,8 @@ php_canonicalize_version(const char *ver
  *  s/([^\d\.])([^\D\.])/$1.$2/g;
  *  s/([^\D\.])([^\d\.])/$1.$2/g;
  */
-#define isdig(x) (isdigit(x)&&(x)!='.')
-#define isndig(x) (!isdigit(x)&&(x)!='.')
+#define isdig(x) (isdigit((unsigned char)(x))&&(x)!='.')
+#define isndig(x) (!isdigit((unsigned char)(x))&&(x)!='.')
 #define isspecialver(x) ((x)=='-'||(x)=='_'||(x)=='+')
 
 		lq = *(q - 1);
@@ -61,7 +61,7 @@ php_canonicalize_version(const char *ver
 				*q++ = '.';
 			}
 			*q++ = *p;
-		} else if (!isalnum(*p)) {
+		} else if (!isalnum((unsigned char)*p)) {
 			if (lq != '.') {
 				*q++ = '.';
 			}
@@ -154,17 +154,17 @@ php_version_compare(const char *orig_ver
 		if ((n2 = strchr(p2, '.')) != NULL) {
 			*n2 = '\0';
 		}
-		if (isdigit(*p1) && isdigit(*p2)) {
+		if (isdigit((unsigned char)*p1) && isdigit((unsigned char)*p2)) {
 			/* compare element numerically */
 			l1 = strtol(p1, NULL, 10);
 			l2 = strtol(p2, NULL, 10);
 			compare = ZEND_NORMALIZE_BOOL(l1 - l2);
-		} else if (!isdigit(*p1) && !isdigit(*p2)) {
+		} else if (!isdigit((unsigned char)*p1) && !isdigit((unsigned char)*p2)) {
 			/* compare element names */
 			compare = compare_special_version_forms(p1, p2);
 		} else {
 			/* mix of names and numbers */
-			if (isdigit(*p1)) {
+			if (isdigit((unsigned char)*p1)) {
 				compare = compare_special_version_forms("#N#", p2);
 			} else {
 				compare = compare_special_version_forms(p1, "#N#");
@@ -182,13 +182,13 @@ php_version_compare(const char *orig_ver
 	}
 	if (compare == 0) {
 		if (n1 != NULL) {
-			if (isdigit(*p1)) {
+			if (isdigit((unsigned char)*p1)) {
 				compare = 1;
 			} else {
 				compare = php_version_compare(p1, "#N#");
 			}
 		} else if (n2 != NULL) {
-			if (isdigit(*p2)) {
+			if (isdigit((unsigned char)*p2)) {
 				compare = -1;
 			} else {
 				compare = php_version_compare("#N#", p2);
Index: php-7.4.33/main/SAPI.c
===================================================================
--- php-7.4.33.orig/main/SAPI.c
+++ php-7.4.33/main/SAPI.c
@@ -195,7 +195,7 @@ static void sapi_read_post_data(void)
 				*p = 0;
 				break;
 			default:
-				*p = tolower(*p);
+				*p = tolower((unsigned char)*p);
 				break;
 		}
 	}
@@ -704,10 +704,10 @@ SAPI_API int sapi_header_op(sapi_header_
 	header_line = estrndup(header_line, header_line_len);
 
 	/* cut off trailing spaces, linefeeds and carriage-returns */
-	if (header_line_len && isspace(header_line[header_line_len-1])) {
+	if (header_line_len && isspace((unsigned char)header_line[header_line_len - 1])) {
 		do {
 			header_line_len--;
-		} while(header_line_len && isspace(header_line[header_line_len-1]));
+		} while(header_line_len && isspace((unsigned char)header_line[header_line_len - 1]));
 		header_line[header_line_len]='\0';
 	}
 
Index: php-7.4.33/main/fopen_wrappers.c
===================================================================
--- php-7.4.33.orig/main/fopen_wrappers.c
+++ php-7.4.33/main/fopen_wrappers.c
@@ -493,7 +493,7 @@ PHPAPI zend_string *php_resolve_path(con
 	}
 
 	/* Don't resolve paths which contain protocol (except of file://) */
-	for (p = filename; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
+	for (p = filename; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
 	if ((*p == ':') && (p - filename > 1) && (p[1] == '/') && (p[2] == '/')) {
 		wrapper = php_stream_locate_url_wrapper(filename, &actual_path, STREAM_OPEN_FOR_INCLUDE);
 		if (wrapper == &php_plain_files_wrapper) {
@@ -529,7 +529,7 @@ PHPAPI zend_string *php_resolve_path(con
 		/* Check for stream wrapper */
 		int is_stream_wrapper = 0;
 
-		for (p = ptr; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
+		for (p = ptr; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
 		if ((*p == ':') && (p - ptr > 1) && (p[1] == '/') && (p[2] == '/')) {
 			/* .:// or ..:// is not a stream wrapper */
 			if (p[-1] != '.' || p[-2] != '.' || p - 2 != ptr) {
@@ -598,7 +598,7 @@ PHPAPI zend_string *php_resolve_path(con
 			actual_path = trypath;
 
 			/* Check for stream wrapper */
-			for (p = trypath; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
+			for (p = trypath; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
 			if ((*p == ':') && (p - trypath > 1) && (p[1] == '/') && (p[2] == '/')) {
 				wrapper = php_stream_locate_url_wrapper(trypath, &actual_path, STREAM_OPEN_FOR_INCLUDE);
 				if (!wrapper) {
Index: php-7.4.33/main/php_ini.c
===================================================================
--- php-7.4.33.orig/main/php_ini.c
+++ php-7.4.33/main/php_ini.c
@@ -42,7 +42,7 @@
 		char *tmp = path; \
 		while (*tmp) { \
 			if (*tmp == '\\') *tmp = '/'; \
-			else *tmp = tolower(*tmp); \
+			else *tmp = tolower((unsigned char)*tmp); \
 				tmp++; \
 		} \
 	}
Index: php-7.4.33/main/php_variables.c
===================================================================
--- php-7.4.33.orig/main/php_variables.c
+++ php-7.4.33/main/php_variables.c
@@ -196,7 +196,7 @@ PHPAPI void php_register_variable_ex(cha
 
 			ip++;
 			index_s = ip;
-			if (isspace(*ip)) {
+			if (isspace((unsigned char)*ip)) {
 				ip++;
 			}
 			if (*ip==']') {
@@ -513,7 +513,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul
 
 		if (arg == PARSE_COOKIE) {
 			/* Remove leading spaces from cookie names, needed for multi-cookie header where ; can be followed by a space */
-			while (isspace(*var)) {
+			while (isspace((unsigned char)*var)) {
 				var++;
 			}
 			if (var == val || *var == '\0') {
Index: php-7.4.33/main/rfc1867.c
===================================================================
--- php-7.4.33.orig/main/rfc1867.c
+++ php-7.4.33/main/rfc1867.c
@@ -421,7 +421,7 @@ static int multipart_buffer_headers(mult
 		}
 
 		/* space in the beginning means same header */
-		if (!isspace(line[0])) {
+		if (!isspace((unsigned char)line[0])) {
 			value = strchr(line, ':');
 		}
 
@@ -437,7 +437,7 @@ static int multipart_buffer_headers(mult
 			}
 
 			*value = '\0';
-			do { value++; } while (isspace(*value));
+			do { value++; } while (isspace((unsigned char)*value));
 
 			key = estrdup(line);
 			smart_string_appends(&buf_value, value);
@@ -534,7 +534,7 @@ static char *substring_conf(char *start,
 
 static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
 {
-	while (*str && isspace(*str)) {
+	while (*str && isspace((unsigned char)*str)) {
 		++str;
 	}
 
@@ -550,7 +550,7 @@ static char *php_ap_getword_conf(const z
 	} else {
 		char *strend = str;
 
-		while (*strend && !isspace(*strend)) {
+		while (*strend && !isspace((unsigned char)*strend)) {
 			++strend;
 		}
 		return substring_conf(str, strend - str, 0);
@@ -817,7 +817,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_
 				goto fileupload_done;
 			}
 
-			while (isspace(*cd)) {
+			while (isspace((unsigned char)*cd)) {
 				++cd;
 			}
 
@@ -825,7 +825,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_
 			{
 				char *key = NULL, *word = pair;
 
-				while (isspace(*cd)) {
+				while (isspace((unsigned char)*cd)) {
 					++cd;
 				}
 
Index: php-7.4.33/main/snprintf.c
===================================================================
--- php-7.4.33.orig/main/snprintf.c
+++ php-7.4.33/main/snprintf.c
@@ -391,7 +391,7 @@ PHPAPI char * php_conv_fp(register char
 	/*
 	 * Check for Infinity and NaN
 	 */
-	if (isalpha((int)*p)) {
+	if (isalpha((unsigned char)*p)) {
 		*len = strlen(p);
 		memcpy(buf, p, *len + 1);
 		*is_negative = FALSE;
@@ -538,11 +538,11 @@ typedef struct buf_area buffy;
 #define NUM( c )			( c - '0' )
 
 #define STR_TO_DEC( str, num )		\
-    num = NUM( *str++ ) ;		\
-    while ( isdigit((int)*str ) )		\
+    num = NUM( *(str)++ ) ;		\
+    while ( isdigit((unsigned char)*(str) ) )		\
     {					\
 	num *= 10 ;			\
-	num += NUM( *str++ ) ;		\
+	num += NUM( *(str)++ ) ;		\
     }
 
 /*
@@ -646,7 +646,7 @@ static int format_converter(register buf
 			/*
 			 * Try to avoid checking for flags, width or precision
 			 */
-			if (isascii((int)*fmt) && !islower((int)*fmt)) {
+			if (isascii((unsigned char)*fmt) && !islower((unsigned char)*fmt)) {
 				/*
 				 * Recognize flags: -, #, BLANK, +
 				 */
@@ -668,7 +668,7 @@ static int format_converter(register buf
 				/*
 				 * Check if a width was specified
 				 */
-				if (isdigit((int)*fmt)) {
+				if (isdigit((unsigned char)*fmt)) {
 					STR_TO_DEC(fmt, min_width);
 					adjust_width = YES;
 				} else if (*fmt == '*') {
@@ -688,7 +688,7 @@ static int format_converter(register buf
 				if (*fmt == '.') {
 					adjust_precision = YES;
 					fmt++;
-					if (isdigit((int)*fmt)) {
+					if (isdigit((unsigned char)*fmt)) {
 						STR_TO_DEC(fmt, precision);
 					} else if (*fmt == '*') {
 						precision = va_arg(ap, int);
Index: php-7.4.33/main/spprintf.c
===================================================================
--- php-7.4.33.orig/main/spprintf.c
+++ php-7.4.33/main/spprintf.c
@@ -152,12 +152,12 @@
 #define NUM(c) (c - '0')
 
 #define STR_TO_DEC(str, num) do {			\
-	num = NUM(*str++);                  	\
-	while (isdigit((int)*str)) {        	\
+	num = NUM(*(str)++);                  	\
+	while (isdigit((unsigned char)*(str))) {\
 		num *= 10;                      	\
-		num += NUM(*str++);             	\
+		num += NUM(*(str)++);             	\
 		if (num >= INT_MAX / 10) {			\
-			while (isdigit((int)*str++));	\
+			while (isdigit((unsigned char)*(str)++));	\
 			break;							\
 		}									\
     }										\
@@ -246,7 +246,7 @@ static void xbuf_format_converter(void *
 			/*
 			 * Try to avoid checking for flags, width or precision
 			 */
-			if (isascii((int)*fmt) && !islower((int)*fmt)) {
+			if (isascii((unsigned char)*fmt) && !islower((unsigned char)*fmt)) {
 				/*
 				 * Recognize flags: -, #, BLANK, +
 				 */
@@ -268,7 +268,7 @@ static void xbuf_format_converter(void *
 				/*
 				 * Check if a width was specified
 				 */
-				if (isdigit((int)*fmt)) {
+				if (isdigit((unsigned char)*fmt)) {
 					STR_TO_DEC(fmt, min_width);
 					adjust_width = YES;
 				} else if (*fmt == '*') {
@@ -288,7 +288,7 @@ static void xbuf_format_converter(void *
 				if (*fmt == '.') {
 					adjust_precision = YES;
 					fmt++;
-					if (isdigit((int)*fmt)) {
+					if (isdigit((unsigned char)*fmt)) {
 						STR_TO_DEC(fmt, precision);
 					} else if (*fmt == '*') {
 						precision = va_arg(ap, int);
Index: php-7.4.33/main/streams/streams.c
===================================================================
--- php-7.4.33.orig/main/streams/streams.c
+++ php-7.4.33/main/streams/streams.c
@@ -1750,7 +1750,7 @@ static inline int php_stream_wrapper_sch
 	unsigned int i;
 
 	for(i = 0; i < protocol_len; i++) {
-		if (!isalnum((int)protocol[i]) &&
+		if (!isalnum((unsigned char)protocol[i]) &&
 			protocol[i] != '+' &&
 			protocol[i] != '-' &&
 			protocol[i] != '.') {
@@ -1830,7 +1830,7 @@ PHPAPI php_stream_wrapper *php_stream_lo
 		return (php_stream_wrapper*)((options & STREAM_LOCATE_WRAPPERS_ONLY) ? NULL : &php_plain_files_wrapper);
 	}
 
-	for (p = path; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++) {
+	for (p = path; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++) {
 		n++;
 	}
 
Index: php-7.4.33/main/streams/transports.c
===================================================================
--- php-7.4.33.orig/main/streams/transports.c
+++ php-7.4.33/main/streams/transports.c
@@ -95,7 +95,7 @@ PHPAPI php_stream *_php_stream_xport_cre
 		}
 	}
 
-	for (p = name; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++) {
+	for (p = name; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++) {
 		n++;
 	}
 
Index: php-7.4.33/sapi/cli/php_cli_server.c
===================================================================
--- php-7.4.33.orig/sapi/cli/php_cli_server.c
+++ php-7.4.33/sapi/cli/php_cli_server.c
@@ -668,7 +668,7 @@ static int sapi_cli_server_register_entr
 			if (key[i] == '-') {
 				key[i] = '_';
 			} else {
-				key[i] = toupper(key[i]);
+				key[i] = toupper((unsigned char)key[i]);
 			}
 		}
 		spprintf(&real_key, 0, "%s_%s", "HTTP", key);
Index: php-7.4.33/sapi/fpm/fpm/fpm_conf.c
===================================================================
--- php-7.4.33.orig/sapi/fpm/fpm/fpm_conf.c
+++ php-7.4.33/sapi/fpm/fpm/fpm_conf.c
@@ -875,7 +875,7 @@ static int fpm_conf_process_all_pools()
 			}
 
 			for (i = 0; i < strlen(status); i++) {
-				if (!isalnum(status[i]) && status[i] != '/' && status[i] != '-' && status[i] != '_' && status[i] != '.' && status[i] != '~') {
+				if (!isalnum((unsigned char)status[i]) && status[i] != '/' && status[i] != '-' && status[i] != '_' && status[i] != '.' && status[i] != '~') {
 					zlog(ZLOG_ERROR, "[pool %s] the status path '%s' must contain only the following characters '[alphanum]/_-.~'", wp->config->name, status);
 					return -1;
 				}
@@ -898,7 +898,7 @@ static int fpm_conf_process_all_pools()
 			}
 
 			for (i = 0; i < strlen(ping); i++) {
-				if (!isalnum(ping[i]) && ping[i] != '/' && ping[i] != '-' && ping[i] != '_' && ping[i] != '.' && ping[i] != '~') {
+				if (!isalnum((unsigned char)ping[i]) && ping[i] != '/' && ping[i] != '-' && ping[i] != '_' && ping[i] != '.' && ping[i] != '~') {
 					zlog(ZLOG_ERROR, "[pool %s] the ping path '%s' must containt only the following characters '[alphanum]/_-.~'", wp->config->name, ping);
 					return -1;
 				}
Index: php-7.4.33/sapi/litespeed/lsapi_main.c
===================================================================
--- php-7.4.33.orig/sapi/litespeed/lsapi_main.c
+++ php-7.4.33/sapi/litespeed/lsapi_main.c
@@ -1738,12 +1738,12 @@ PHP_FUNCTION(litespeed_response_headers)
             len = p - h->header;
             if (p && len > 0 && len < LSAPI_RESP_HTTP_HEADER_MAX) {
                 memmove( headerBuf, h->header, len );
-                while( len > 0 && (isspace( headerBuf[len-1])) ) {
+                while( len > 0 && (isspace((unsigned char)headerBuf[len - 1])) ) {
                     --len;
                 }
                 headerBuf[len] = 0;
                 if ( len ) {
-                    while( isspace(*++p));
+                    while(isspace((unsigned char)*++p));
                     add_assoc_string_ex(return_value, headerBuf, len, p);
                 }
             }
Index: php-7.4.33/sapi/litespeed/lsapilib.c
===================================================================
--- php-7.4.33.orig/sapi/litespeed/lsapilib.c
+++ php-7.4.33/sapi/litespeed/lsapilib.c
@@ -2199,7 +2199,7 @@ static char * GetHeaderVar( LSAPI_Reques
 
             while(( pKey < pKeyEnd )&&( *p ))
             {
-                char ch = toupper( *pKey );
+                char ch = toupper( (unsigned char)*pKey );
                 if ((ch != *p )||(( *p == '_' )&&( ch != '-')))
                     break;
                 ++p; ++pKey;
@@ -2383,7 +2383,7 @@ int LSAPI_ForeachHeader_r( LSAPI_Request
                 if ( ch == '-' )
                     *p++ = '_';
                 else
-                    *p++ = toupper( ch );
+                    *p++ = toupper( (unsigned char)ch );
             }
             *p = 0;
             keyLen += 5;
@@ -2628,7 +2628,7 @@ int LSAPI_ParseSockAddr( const char * pB
     if ( !pBind )
         return -1;
 
-    while( isspace( *pBind ) )
+    while(isspace( (unsigned char)*pBind ) )
         ++pBind;
 
     strncpy(achAddr, pBind, 255);
Index: php-7.4.33/sapi/phpdbg/phpdbg_cmd.c
===================================================================
--- php-7.4.33.orig/sapi/phpdbg/phpdbg_cmd.c
+++ php-7.4.33/sapi/phpdbg/phpdbg_cmd.c
@@ -785,9 +785,9 @@ PHPDBG_API char *phpdbg_read_input(char
 #endif
 	}
 
-	if (buffer && isspace(*buffer)) {
+	if (buffer && isspace((unsigned char)*buffer)) {
 		char *trimmed = buffer;
-		while (isspace(*trimmed))
+		while (isspace((unsigned char)*trimmed))
 			trimmed++;
 
 		trimmed = estrdup(trimmed);
Index: php-7.4.33/sapi/phpdbg/phpdbg_prompt.c
===================================================================
--- php-7.4.33.orig/sapi/phpdbg/phpdbg_prompt.c
+++ php-7.4.33/sapi/phpdbg/phpdbg_prompt.c
@@ -221,7 +221,7 @@ static void phpdbg_line_init(char *cmd,
 
 	state->line++;
 
-	while (cmd_len > 0L && isspace(cmd[cmd_len-1])) {
+	while (cmd_len > 0L && isspace((unsigned char)cmd[cmd_len-1])) {
 		cmd_len--;
 	}
 
Index: php-7.4.33/sapi/phpdbg/phpdbg_utils.c
===================================================================
--- php-7.4.33.orig/sapi/phpdbg/phpdbg_utils.c
+++ php-7.4.33/sapi/phpdbg/phpdbg_utils.c
@@ -85,10 +85,10 @@ PHPDBG_API int phpdbg_is_numeric(const c
 		return 0;
 
 	for (; *str; str++) {
-		if (isspace(*str) || *str == '-') {
+		if (isspace((unsigned char)*str) || *str == '-') {
 			continue;
 		}
-		return isdigit(*str);
+		return isdigit((unsigned char)*str);
 	}
 	return 0;
 } /* }}} */
@@ -99,7 +99,7 @@ PHPDBG_API int phpdbg_is_empty(const cha
 		return 1;
 
 	for (; *str; str++) {
-		if (isspace(*str)) {
+		if (isspace((unsigned char)*str)) {
 			continue;
 		}
 		return 0;
@@ -202,12 +202,12 @@ PHPDBG_API char *phpdbg_trim(const char
 	const char *p = str;
 	char *new = NULL;
 
-	while (p && isspace(*p)) {
+	while (p && isspace((unsigned char)*p)) {
 		++p;
 		--len;
 	}
 
-	while (*p && isspace(*(p + len -1))) {
+	while (*p && isspace((unsigned char)p[len - 1])) {
 		--len;
 	}
 
Index: php-7.4.33/win32/sendmail.c
===================================================================
--- php-7.4.33.orig/win32/sendmail.c
+++ php-7.4.33/win32/sendmail.c
@@ -57,7 +57,7 @@
 												efree(response); \
 											} \
 										}
-#define SMTP_SKIP_SPACE(str)	{ while (isspace(*str)) { str++; } }
+#define SMTP_SKIP_SPACE(str)	{ while (isspace((unsigned char)*(str))) { (str)++; } }
 
 
 char seps[] = " ,\t\n";
@@ -724,7 +724,7 @@ static int PostHeader(char *RPath, char
 		headers_lc_len = strlen(headers_lc);
 
 		for (i = 0; i < headers_lc_len; i++) {
-			headers_lc[i] = tolower(headers_lc[i]);
+			headers_lc[i] = tolower((unsigned char)headers_lc[i]);
 		}
 	}
 
@@ -852,7 +852,7 @@ return 0;
 
 	/* Resolve the servers IP */
 	/*
-	if (!isdigit(PW32G(mail_host)[0])||!gethostbyname(PW32G(mail_host)))
+	if (!isdigit((unsigned char)PW32G(mail_host)[0])||!gethostbyname(PW32G(mail_host)))
 	{
 		return (FAILED_TO_RESOLVE_HOST);
 	}