Update NEWS for PHP 7.2.21

* PHP-7.1:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)

NEWS

@@ -1,6 +1,15 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.21
+01 Aug 2019, PHP 7.2.21
+
+- Date:
+  . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
+
+- EXIF:
+  . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment).
+    (CVE-2019-11042) (Stas)
+  . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
+    (CVE-2019-11041) (Stas)
 
 - Fileinfo:
   . Fixed bug #78183 (finfo_file shows wrong mime-type for .tga file).
@@ -9,20 +18,6 @@ PHP                                                                        NEWS
 - FTP:
   . Fixed bug #77124 (FTP with SSL memory leak). (Nikita)
 
-- PDO_Sqlite:
-  . Fixed bug #78192 (SegFault when reuse statement after schema has changed).
-    (Vincent Quatrevieux)
-
-- SQLite:
-  . Upgraded to SQLite 3.28.0. (cmb)
-
-- XMLRPC:
-  . Fixed bug #78173 (XML-RPC mutates immutable objects during encoding).
-    (Asher Baker)
-
-- Date:
-  . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
-
 - Libxml:
   . Fixed bug #78279 (libxml_disable_entity_loader settings is shared between
     requests (cgi-fcgi)). (Nikita)
@@ -45,12 +40,29 @@ PHP                                                                        NEWS
   . Fixed bug #78291 (opcache_get_configuration doesn't list all directives).
     (Andrew Collington)
 
+- Phar:
+  . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb)
+
+- Phpdbg:
+  . Fixed bug #78297 (Include unexistent file memory leak). (Nikita)
+
+- PDO_Sqlite:
+  . Fixed bug #78192 (SegFault when reuse statement after schema has changed).
+    (Vincent Quatrevieux)
+
+- SQLite:
+  . Upgraded to SQLite 3.28.0. (cmb)
+
 - Standard:
   . Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit).
     (cmb)
   . Fixed bug #78269 (password_hash uses weak options for argon2). (Remi)
 
-27 Jun 2019, PHP 7.2.20
+- XMLRPC:
+  . Fixed bug #78173 (XML-RPC mutates immutable objects during encoding).
+    (Asher Baker)
+
+04 Jul 2019, PHP 7.2.20
 
 - Core:
   . Fixed bug #76980 (Interface gets skipped if autoloader throws an exception).

ext/exif/exif.c

@@ -3040,11 +3040,11 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
-			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
+			if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
 				decode = "UCS-2BE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
-			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
+			} else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
 				decode = "UCS-2LE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
@@ -3919,7 +3919,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 	size_t          length=2, pos=0;
 	jpeg_sof_info   sof_info;
 
-	if (!data) {
+	if (!data || ImageInfo->Thumbnail.size < 4) {
 		return FALSE; /* nothing to do here */
 	}
 	if (memcmp(data, "\xFF\xD8\xFF", 3)) {

ext/exif/tests/bug78222.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug78222.jpg", 'THUMBNAIL', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE

ext/exif/tests/bug78256.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #78256 (heap-buffer-overflow on exif_process_user_comment)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+@exif_read_data(__DIR__."/bug78256.jpg", 'COMMENT', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE

ext/phar/phar_object.c

@@ -2037,7 +2037,7 @@ static zend_object *phar_rename_archive(phar_archive_data **sphar, char *ext) /*
 	char *newname = NULL, *newpath = NULL;
 	zval ret, arg1;
 	zend_class_entry *ce;
-	char *error;
+	char *error = NULL;
 	const char *pcr_error;
 	int ext_len = ext ? strlen(ext) : 0;
 	size_t new_len, oldname_len, phar_ext_len;
@@ -2252,6 +2252,8 @@ its_ok:
 	phar_flush(phar, 0, 0, 1, &error);
 
 	if (error) {
+		zend_hash_str_del(&(PHAR_G(phar_fname_map)), newpath, phar->fname_len);
+		*sphar = NULL;
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "%s", error);
 		efree(error);
 		efree(oldpath);

ext/phar/tests/bug71488.phpt

@@ -15,4 +15,7 @@ DONE
 ?>
 --EXPECTF--
 Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d
-Stack trace:%A
+Stack trace:
+#0 %s(%d): PharData->decompress('test')
+#1 {main}
+  thrown in %s on line %d

ext/standard/credits_ext.h

@@ -1,11 +1,11 @@
-/* 
+/*
                       DO NOT EDIT THIS FILE!
 
- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
  the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
  CREDITS file instead
 
 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");

ext/standard/credits_sapi.h

@@ -1,11 +1,11 @@
-/* 
+/*
                       DO NOT EDIT THIS FILE!
 
- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
  the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
  CREDITS file instead
 
 */

sapi/phpdbg/phpdbg_list.c

@@ -248,6 +248,7 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 		} else {
 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file->filename);
 		}
+		return NULL;
 	}
 
 	data.buf = estrndup(bufptr, len);

sapi/phpdbg/tests/bug78297.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #78297: Include unexistent file memory leak
+--PHPDBG--
+r
+q
+--FILE--
+<?php
+include "does_not_exist.php";
+--EXPECTF--
+[Successful compilation of %s]
+prompt> 
+Warning: include(%s): failed to open stream: No such file or directory in %s on line %d
+
+Warning: include(): Failed opening 'does_not_exist.php' for inclusion (include_path=%s) in %s on line %d
+[Script ended normally]
+prompt>