Merge branch 'v2.6.x'

diff --cc .gitignore
index 328656c61a95866820f9b69f4b846b30766e2e42,45ac1a5f203ae766bd3662ce1fe7a59e677ceb02..348538c871f9b28e83aab75ed0d0bc888950a349
--- 1/.gitignore
--- 2/.gitignore
+++ b/.gitignore
@@@ -40,37 -40,38 +40,74 @@@ tests/*.s
  lcov_data
  *~
  *.phar
 +!travis/*.phar
  vendor/
++<<<<<<< HEAD
 +/php_http_api.h
 +/php_http_buffer.h
 +/php_http_client.h
 +/php_http_client_curl.h
 +/php_http_client_request.h
 +/php_http_client_response.h
 +/php_http_cookie.h
 +/php_http_curl.h
 +/php_http_encoding.h
 +/php_http_env.h
 +/php_http_env_request.h
 +/php_http_env_response.h
 +/php_http_etag.h
 +/php_http_exception.h
 +/php_http_filter.h
 +/php_http_header.h
 +/php_http_header_parser.h
 +/php_http_info.h
 +/php_http_message.h
 +/php_http_message_body.h
 +/php_http_message_parser.h
 +/php_http_misc.h
 +/php_http_negotiate.h
 +/php_http_object.h
 +/php_http_options.h
 +/php_http_params.h
 +/php_http_querystring.h
 +/php_http_response_codes.h
 +/php_http_url.h
 +/php_http_utf8.h
 +/php_http_version.h
 +/tests/helper/server.log
++=======
+ tests/helper/server.log
+ php_http_api.h
+ php_http_buffer.h
+ php_http_client.h
+ php_http_client_curl.h
+ php_http_client_curl_event.h
+ php_http_client_curl_user.h
+ php_http_client_request.h
+ php_http_client_response.h
+ php_http_cookie.h
+ php_http_curl.h
+ php_http_encoding.h
+ php_http_env.h
+ php_http_env_request.h
+ php_http_env_response.h
+ php_http_etag.h
+ php_http_exception.h
+ php_http_filter.h
+ php_http_header.h
+ php_http_header_parser.h
+ php_http_info.h
+ php_http_message.h
+ php_http_message_body.h
+ php_http_message_parser.h
+ php_http_misc.h
+ php_http_negotiate.h
+ php_http_object.h
+ php_http_options.h
+ php_http_params.h
+ php_http_querystring.h
+ php_http_response_codes.h
+ php_http_url.h
+ php_http_utf8.h
+ php_http_version.h
++>>>>>>> v2.6.x

diff --cc package.xml
index 29942ef774afdfda9dcb8801c7b69252734bff57,7191f314ad8cc64d1d99491e09010f271a89ae9c..fe4e1b0280966f59893e51d7864857920835ff27
--- 1/package.xml
--- 2/package.xml
+++ b/package.xml
@@@ -31,10 -31,10 +31,10 @@@ https://mdref.m6w6.name/htt
    <email>mike@php.net</email>
    <active>yes</active>
   </lead>
-  <date>2016-09-07</date>
+  <date>2016-09-12</date>
   <version>
-   <release>3.1.0beta2</release>
 -  <release>2.6.0RC1</release>
 -  <api>2.6.0</api>
++  <release>3.1.0RC1</release>
 +  <api>3.1.0</api>
   </version>
   <stability>
    <release>beta</release>
@@@ -64,10 -64,15 +64,14 @@@
  * Fix gh-issue #36: Unexpected cookies sent if persistent_handle_id is used (Mike, @rcanavan, @afflerbach)
  * Fix gh-issue #34: allow setting multiple headers with the same name (Mike, @rcanavan)
  * Fix gh-issue #33: allow setting prodyhost request option to NULL (Mike, @rcanavan)
 -* Fix gh-issue #31: add/improve configure checks for default CA bundle/path (Mike, @rcanavan) 
 +* Fix gh-issue #31: add/improve configure checks for default CA bundle/path (Mike, @rcanavan)
  
  Changes from beta1:
 -* Fixed PHP-5.3 compatibility
  * Fixed recursive calls to the event loop dispatcher
+ 
+ Changes from beta2:
+ * Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
+ * Fix HTTP/2 version parser for older libcurl versions (Mike)
  ]]></notes>
   <contents>
    <dir name="/">

diff --cc src/php_http_params.c
index 8988f43c65c0cd33dcd9ff7220304c0c4065d7bd,90710684deabe6d08bd5e81d8e1563086f0095a6..92cc558962af525355cfa0fc32672dd858e8e3a5
--- 1/src/php_http_params.c
--- 2/src/php_http_params.c
+++ b/src/php_http_params.c
@@@ -486,20 -465,20 +486,20 @@@ static void merge_param(HashTable *para
                         * zdata  = [arr => [0 => NULL]]
                         *                  ^- zdata_ptr
                         */
 -                      zval **test_ptr;
 +                      zval *test_ptr;
  
 -                      while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
 -                      &&      SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
 -                      ) {
 -                              if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {
 +                      while (Z_TYPE_P(zdata_ptr) == IS_ARRAY && (test_ptr = zend_hash_get_current_data(Z_ARRVAL_P(zdata_ptr)))) {
-                               if (Z_TYPE_P(test_ptr) == IS_ARRAY) {
++                              if (Z_TYPE_P(test_ptr) == IS_ARRAY && Z_TYPE_P(ptr) == IS_ARRAY) {
 +                                      zval *tmp_ptr = ptr;
  
                                        /* now find key in ptr */
 -                                      if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {
 -                                              if (SUCCESS == zend_hash_find(Z_ARRVAL_PP(ptr), hkey.str, hkey.len, (void *) &ptr)) {
 +                                      if (HASH_KEY_IS_STRING == zend_hash_get_current_key(Z_ARRVAL_P(zdata_ptr), &hkey.key, &hkey.h)) {
 +                                              if ((ptr = zend_hash_find(Z_ARRVAL_P(ptr), hkey.key))) {
                                                        zdata_ptr = test_ptr;
                                                } else {
 -                                                      Z_ADDREF_PP(test_ptr);
 -                                                      zend_hash_update(Z_ARRVAL_PP(ptr), hkey.str, hkey.len, (void *) test_ptr, sizeof(zval *), (void *) &ptr);
 +                                                      ptr = tmp_ptr;
 +                                                      Z_TRY_ADDREF_P(test_ptr);
 +                                                      ptr = zend_hash_update(Z_ARRVAL_P(ptr), hkey.key, test_ptr);
                                                        break;
                                                }
                                        } else {