Update NEWS for PHP 7.2.3

This reverts commit afdd6fe61e.
This reverts commit 9a0c5b6d19.

NEWS

@@ -1,6 +1,6 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.2.3
+01 Mar 2018, PHP 7.2.3
 
 - Core:
   . Fixed bug #75864 ("stream_isatty" returns wrong value on s390x). (Sam Ding)
@@ -48,6 +48,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #75916 (DNS_CAA record results contain garbage). (Mike,
     Philip Sharp)
+  . Fixed bug #75981 (Prevent reading beyond buffer start in http wrapper).
+    (Stas)
 
 01 Feb 2018, PHP 7.2.2
 
@@ -273,6 +275,8 @@ PHP                                                                        NEWS
     DateTimeInterface interface). (Majkl578)
   . Fixed bug #75149 (redefinition of typedefs ttinfo and t1info). (Remi)
   . Fixed bug #75222 (DateInterval microseconds property always 0). (jhdxr)
+  . Fixed bug #68406 (calling var_dump on a DateTimeZone object modifies it).
+    (jhdxr)
 
 - Dba:
   . Fixed bug #72885 (flatfile: dba_fetch() fails to read replaced entry).

ext/date/php_date.c

@@ -2422,9 +2422,9 @@ static HashTable *date_object_get_debug_info_timezone(zval *object, int *is_temp
 			zend_string *tmpstr = zend_string_alloc(sizeof("UTC+05:00")-1, 0);
 
 			ZSTR_LEN(tmpstr) = snprintf(ZSTR_VAL(tmpstr), sizeof("+05:00"), "%c%02d:%02d",
-			tzobj->tzi.utc_offset > 0 ? '-' : '+',
-			abs(tzobj->tzi.utc_offset / 60),
-			abs((tzobj->tzi.utc_offset % 60)));
+				tzobj->tzi.utc_offset < 0 ? '-' : '+',
+				abs((int)(tzobj->tzi.utc_offset / 3600)),
+				abs(((int)(tzobj->tzi.utc_offset % 3600) / 60)));
 
 			ZVAL_NEW_STR(&zv, tmpstr);
 			}

ext/standard/http_fopen_wrapper.c

@@ -718,9 +718,9 @@ finish:
 								tmp_line, response_code);
 				}
 			}
-			if (tmp_line[tmp_line_len - 1] == '\n') {
+			if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
 				--tmp_line_len;
-				if (tmp_line[tmp_line_len - 1] == '\r') {
+				if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
 					--tmp_line_len;
 				}
 			}

ext/standard/tests/http/bug75981.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #75981 (stack-buffer-overflow while parsing HTTP response)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+$options = [
+  'http' => [
+    'protocol_version' => '1.1',
+    'header' => 'Connection: Close'
+  ],
+];
+
+$ctx = stream_context_create($options);
+
+$responses = [
+	"data://text/plain,000000000100\xA\xA"
+];
+$pid = http_server('tcp://127.0.0.1:12342', $responses);
+
+echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);
+
+http_server_kill($pid);
+
+?>
+DONE
+--EXPECT--
+DONE