Prepare PHP 7.3.8

We backport r1092 from pcre2.

(cherry picked from commit 8947fd9e9f)

NEWS

@@ -1,6 +1,6 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.8
+01 Aug 2019, PHP 7.3.8
 
 - Core:
   . Added syslog.filter=raw option. (Erik Lundin)
@@ -10,6 +10,12 @@ PHP                                                                        NEWS
   . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
   . Updated timelib to 2018.02. (Derick)
 
+- EXIF:
+  . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment).
+    (CVE-2019-11042) (Stas)
+  . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
+    (CVE-2019-11041) (Stas)
+
 - FTP:
   . Fixed bug #78039 (FTP with SSL memory leak). (Nikita)
 
@@ -29,6 +35,7 @@ PHP                                                                        NEWS
     socket-to-stream). (Nikita)
 
 - Opcache:
+  . Fixed bug #78341 (Failure to detect smart branch in DFA pass). (Nikita)
   . Fixed bug #78189 (file cache strips last character of uname hash). (cmb)
   . Fixed bug #78202 (Opcache stats for cache hits are capped at 32bit NUM).
     (cmb)
@@ -37,6 +44,7 @@ PHP                                                                        NEWS
     (Andrew Collington)
 
 - PCRE:
+  . Fixed bug #78338 (Array cross-border reading in PCRE). (cmb)
   . Fixed bug #78197 (PCRE2 version check in configure fails for "##.##-xxx"
     version strings). (pgnet, Peter Kokot)
 
@@ -44,6 +52,12 @@ PHP                                                                        NEWS
   . Fixed bug #78192 (SegFault when reuse statement after schema has changed).
     (Vincent Quatrevieux)
 
+- Phar:
+  . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb)
+
+- Phpdbg:
+  . Fixed bug #78297 (Include unexistent file memory leak). (Nikita)
+
 - SQLite:
   . Upgraded to SQLite 3.28.0. (cmb)
 

Zend/tests/bug78271.phpt

@@ -1,7 +1,7 @@
 --TEST--
 Bug #78271: Invalid result of if-else
 --FILE--
-<?
+<?php
 function test($a, $b){
     if ($a==10) {
         $w="x";

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.8-dev"
+#define ZEND_VERSION "3.3.8"
 
 #define ZEND_ENGINE_3
 

configure.ac

@@ -108,7 +108,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=8
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/exif/exif.c

@@ -3015,11 +3015,11 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
-			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
+			if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
 				decode = "UCS-2BE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
-			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
+			} else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
 				decode = "UCS-2LE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
@@ -3892,7 +3892,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 	size_t          length=2, pos=0;
 	jpeg_sof_info   sof_info;
 
-	if (!data) {
+	if (!data || ImageInfo->Thumbnail.size < 4) {
 		return FALSE; /* nothing to do here */
 	}
 	if (memcmp(data, "\xFF\xD8\xFF", 3)) {

ext/exif/tests/bug78222.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug78222.jpg", 'THUMBNAIL', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE

ext/exif/tests/bug78256.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #78256 (heap-buffer-overflow on exif_process_user_comment)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+@exif_read_data(__DIR__."/bug78256.jpg", 'COMMENT', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE

ext/opcache/Optimizer/dfa_pass.c

@@ -181,9 +181,8 @@ static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_op
 
 	for (b = blocks; b < blocks_end; b++) {
 		if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
-			uint32_t end;
-
 			if (b->len) {
+				uint32_t new_start, old_end;
 				while (i < b->start) {
 					shiftlist[i] = i - target;
 					i++;
@@ -196,9 +195,9 @@ static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_op
 					b->len = 1;
 				}
 
-				end = b->start + b->len;
-				b->start = target;
-				while (i < end) {
+				new_start = target;
+				old_end = b->start + b->len;
+				while (i < old_end) {
 					shiftlist[i] = i - target;
 					if (EXPECTED(op_array->opcodes[i].opcode != ZEND_NOP) ||
 						is_smart_branch_inhibiting_nop(op_array, target, i, b, blocks_end)) {
@@ -211,12 +210,13 @@ static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_op
 					}
 					i++;
 				}
-				if (target != end) {
+				b->start = new_start;
+				if (target != old_end) {
 					zend_op *opline;
 					zend_op *new_opline;
 
 					b->len = target - b->start;
-					opline = op_array->opcodes + end - 1;
+					opline = op_array->opcodes + old_end - 1;
 					if (opline->opcode == ZEND_NOP) {
 						continue;
 					}

ext/opcache/tests/bug78341.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #78341: Failure to detect smart branch in DFA pass
+--FILE--
+<?php
+
+function test($a) {
+    // Just some dead code...
+    if (strpos("foo", "foo") !== 0) {
+        echo "Foo";
+    }
+
+    $x = $a === null;
+    if ($x) {
+        var_dump($x);
+    }
+}
+test(null);
+
+?>
+--EXPECT--
+bool(true)

ext/pcre/pcre2lib/pcre2_jit_compile.c

@@ -7288,7 +7288,7 @@ int lgb, rgb, ricount;
 PCRE2_SPTR bptr;
 uint32_t c;
 
-GETCHARINC(c, cc);
+c = *cc++;
 lgb = UCD_GRAPHBREAK(c);
 
 while (cc < end_subject)

ext/pcre/tests/bug78338.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #78338 (Array cross-border reading in PCRE)
+--FILE--
+<?php
+$string = hex2bin('2f5c583f3d3f223f3536ff3636ffffffff36a8a8a83636367a7a7a7a3d2aff2f0a');
+preg_match($string, $string);
+echo "DONE\n";
+?>
+--EXPECT--
+DONE

ext/phar/phar_object.c

@@ -1990,7 +1990,7 @@ static zend_object *phar_rename_archive(phar_archive_data **sphar, char *ext) /*
 	char *newname = NULL, *newpath = NULL;
 	zval ret, arg1;
 	zend_class_entry *ce;
-	char *error;
+	char *error = NULL;
 	const char *pcr_error;
 	size_t ext_len = ext ? strlen(ext) : 0;
 	size_t new_len, oldname_len, phar_ext_len;
@@ -2200,6 +2200,8 @@ its_ok:
 	phar_flush(phar, 0, 0, 1, &error);
 
 	if (error) {
+		zend_hash_str_del(&(PHAR_G(phar_fname_map)), newpath, phar->fname_len);
+		*sphar = NULL;
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "%s", error);
 		efree(error);
 		efree(oldpath);

ext/phar/tests/bug71488.phpt

@@ -15,4 +15,7 @@ DONE
 ?>
 --EXPECTF--
 Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d
-Stack trace:%A
+Stack trace:
+#0 %s(%d): PharData->decompress('test')
+#1 {main}
+  thrown in %s on line %d

ext/standard/credits_ext.h

@@ -17,8 +17,8 @@ CREDIT_LINE("COM and .Net", "Wez Furlong");
 CREDIT_LINE("ctype", "Hartmut Holzgraefe");
 CREDIT_LINE("cURL", "Sterling Hughes");
 CREDIT_LINE("Date/Time Support", "Derick Rethans");
-CREDIT_LINE("DB-LIB (MS SQL, Sybase)", "Wez Furlong, Frank M. Kromann, Adam Baratz");
 CREDIT_LINE("DBA", "Sascha Schumann, Marcus Boerger");
+CREDIT_LINE("DB-LIB (MS SQL, Sybase)", "Wez Furlong, Frank M. Kromann, Adam Baratz");
 CREDIT_LINE("DOM", "Christian Stocker, Rob Richards, Marcus Boerger");
 CREDIT_LINE("enchant", "Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("EXIF", "Rasmus Lerdorf, Marcus Boerger");
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");
@@ -66,17 +66,17 @@ CREDIT_LINE("SOAP", "Brad Lafountain, Shane Caraveo, Dmitry Stogov");
 CREDIT_LINE("Sockets", "Chris Vandomelen, Sterling Hughes, Daniel Beulshausen, Jason Greene");
 CREDIT_LINE("Sodium", "Frank Denis");
 CREDIT_LINE("SPL", "Marcus Boerger, Etienne Kneuss");
-CREDIT_LINE("SQLite 3.x driver for PDO", "Wez Furlong");
 CREDIT_LINE("SQLite3", "Scott MacVicar, Ilia Alshanetsky, Brad Dewar");
+CREDIT_LINE("SQLite 3.x driver for PDO", "Wez Furlong");
 CREDIT_LINE("System V Message based IPC", "Wez Furlong");
 CREDIT_LINE("System V Semaphores", "Tom May");
 CREDIT_LINE("System V Shared Memory", "Christian Cartus");
 CREDIT_LINE("tidy", "John Coggeshall, Ilia Alshanetsky");
 CREDIT_LINE("tokenizer", "Andrei Zmievski, Johannes Schlueter");
 CREDIT_LINE("WDDX", "Andrei Zmievski");
-CREDIT_LINE("XML", "Stig Bakken, Thies C. Arntzen, Sterling Hughes");
 CREDIT_LINE("XMLReader", "Rob Richards");
 CREDIT_LINE("xmlrpc", "Dan Libby");
+CREDIT_LINE("XML", "Stig Bakken, Thies C. Arntzen, Sterling Hughes");
 CREDIT_LINE("XMLWriter", "Rob Richards, Pierre-Alain Joye");
 CREDIT_LINE("XSL", "Christian Stocker, Rob Richards");
 CREDIT_LINE("Zip", "Pierre-Alain Joye, Remi Collet");

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 8
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.3.8-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.3.8"
 #define PHP_VERSION_ID 70308

sapi/phpdbg/phpdbg_list.c

@@ -248,6 +248,7 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 		} else {
 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file->filename);
 		}
+		return NULL;
 	}
 
 	data.buf = estrndup(bufptr, len);

sapi/phpdbg/tests/bug78297.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #78297: Include unexistent file memory leak
+--PHPDBG--
+r
+q
+--FILE--
+<?php
+include "does_not_exist.php";
+--EXPECTF--
+[Successful compilation of %s]
+prompt> 
+Warning: include(%s): failed to open stream: No such file or directory in %s on line %d
+
+Warning: include(): Failed opening 'does_not_exist.php' for inclusion (include_path=%s) in %s on line %d
+[Script ended normally]
+prompt>