Fix #78876: Long variables cause OOM and temp files are not cleaned

We use the proper type for size calculations, which is `size_t`.

(cherry picked from commit 3c8582ca4b)

NEWS

@@ -1,10 +1,12 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.19
-
-30 Apr 2020, PHP 7.3.18RC1
+14 May 2020, PHP 7.3.18
 
 - Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
+    files are not cleaned). (CVE-2019-11048) (cmb)
   . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
     on !CS constant). (Nikita)
   . Fixed bug #79477 (casting object into array creates references). (Nikita)
@@ -31,6 +33,10 @@ PHP                                                                        NEWS
 - Phar:
   . Fix bug #79503 (Memory leak on duplicate metadata). (cmb)
 
+- SimpleXML:
+  . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
+    7.4.4). (cmb)
+
 - Standard:
   . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
     appended). (dinosaur)

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.19-dev"
+#define ZEND_VERSION "3.3.18"
 
 #define ZEND_ENGINE_3
 

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=19
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=18
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/simplexml/simplexml.c

@@ -964,7 +964,7 @@ static void _get_base_node_value(php_sxe_object *sxe_ref, xmlNodePtr node, zval
 	php_sxe_object *subnode;
 	xmlChar        *contents;
 
-	if ((!node->properties || node->type == XML_ENTITY_DECL) && node->children && node->children->type == XML_TEXT_NODE && !xmlIsBlankNode(node->children)) {
+	if (node->children && node->children->type == XML_TEXT_NODE && !xmlIsBlankNode(node->children)) {
 		contents = xmlNodeListGetString(node->doc, node->children, 1);
 		if (contents) {
 			ZVAL_STRING(value, (char *)contents);

ext/simplexml/tests/000.phpt

@@ -51,37 +51,7 @@ object(SimpleXMLElement)#%d (3) {
   ["elem1"]=>
   array(2) {
     [0]=>
-    object(SimpleXMLElement)#%d (3) {
-      ["@attributes"]=>
-      array(2) {
-        ["attr1"]=>
-        string(5) "first"
-        ["attr2"]=>
-        string(6) "second"
-      }
-      ["comment"]=>
-      object(SimpleXMLElement)#%d (0) {
-      }
-      ["elem2"]=>
-      object(SimpleXMLElement)#%d (2) {
-        ["@attributes"]=>
-        array(2) {
-          ["att25"]=>
-          string(2) "25"
-          ["att42"]=>
-          string(2) "42"
-        }
-        ["elem3"]=>
-        object(SimpleXMLElement)#%d (1) {
-          ["elem4"]=>
-          object(SimpleXMLElement)#%d (1) {
-            ["test"]=>
-            object(SimpleXMLElement)#%d (0) {
-            }
-          }
-        }
-      }
-    }
+    string(36) "There is some text.Here is some more"
     [1]=>
     object(SimpleXMLElement)#%d (1) {
       ["@attributes"]=>

ext/simplexml/tests/009b.phpt

@@ -28,29 +28,8 @@ object(SimpleXMLElement)#%d (3) {
     string(5) "elem1"
   }
   ["elem1"]=>
-  object(SimpleXMLElement)#%d (3) {
-    ["@attributes"]=>
-    array(1) {
-      ["attr1"]=>
-      string(5) "first"
-    }
-    ["comment"]=>
-    object(SimpleXMLElement)#%d (0) {
-    }
-    ["elem2"]=>
-    string(35) "
-   Here we have some text data.
-  "
-  }
+  string(10) "Bla bla 1."
   ["elem11"]=>
-  object(SimpleXMLElement)#%d (2) {
-    ["@attributes"]=>
-    array(1) {
-      ["attr2"]=>
-      string(6) "second"
-    }
-    [0]=>
-    string(10) "Bla bla 2."
-  }
+  string(10) "Bla bla 2."
 }
 ===DONE===

ext/simplexml/tests/bug51615.phpt

@@ -22,7 +22,7 @@ foreach ($html->body->span as $obj) {
 Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d
 
 Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d
-object(SimpleXMLElement)#5 (3) {
+object(SimpleXMLElement)#%d (3) {
   ["@attributes"]=>
   array(2) {
     ["title"]=>
@@ -31,29 +31,9 @@ object(SimpleXMLElement)#5 (3) {
     string(0) ""
   }
   [0]=>
-  object(SimpleXMLElement)#4 (2) {
-    ["@attributes"]=>
-    array(2) {
-      ["title"]=>
-      string(0) ""
-      ["y"]=>
-      string(0) ""
-    }
-    [0]=>
-    string(1) "x"
-  }
+  string(1) "x"
   [1]=>
-  object(SimpleXMLElement)#6 (2) {
-    ["@attributes"]=>
-    array(2) {
-      ["title"]=>
-      string(0) ""
-      ["z"]=>
-      string(0) ""
-    }
-    [0]=>
-    string(1) "x"
-  }
+  string(1) "x"
 }
 string(0) ""
 string(0) ""

ext/simplexml/tests/bug61597.phpt

@@ -1,30 +0,0 @@
---TEST--
-Bug #61597 (SXE properties may lack attributes and content)
---SKIPIF--
-<?php
-if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
-?>
---FILE--
-<?php
-$xml = <<<'EOX'
-<?xml version="1.0"?>
-<data>
-<datum file-key="8708124062829849862">corn</datum>
-</data>
-EOX;
-
-var_dump(simplexml_load_string($xml));
-?>
---EXPECTF--
-object(SimpleXMLElement)#%d (1) {
-  ["datum"]=>
-  object(SimpleXMLElement)#%d (2) {
-    ["@attributes"]=>
-    array(1) {
-      ["file-key"]=>
-      string(19) "8708124062829849862"
-    }
-    [0]=>
-    string(4) "corn"
-  }
-}

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 3
-#define PHP_RELEASE_VERSION 19
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.3.19-dev"
-#define PHP_VERSION_ID 70319
+#define PHP_RELEASE_VERSION 18
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.3.18"
+#define PHP_VERSION_ID 70318

main/rfc1867.c

@@ -614,7 +614,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
 }
 
 /* read until a boundary condition */
-static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
 {
 	size_t len, max;
 	char *bound;
@@ -653,7 +653,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 		self->buf_begin += len;
 	}
 
-	return (int)len;
+	return len;
 }
 
 /*
@@ -663,7 +663,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
 {
 	char buf[FILLUNIT], *out=NULL;
-	int total_bytes=0, read_bytes=0;
+	size_t total_bytes=0, read_bytes=0;
 
 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -690,7 +690,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *lbuf = NULL, *abuf = NULL;
 	zend_string *temp_filename = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
+	size_t array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	HashTable *uploaded_files = NULL;
@@ -1124,7 +1125,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
 
 			if (is_arr_upload) {
-				array_len = (int)strlen(start_arr);
+				array_len = strlen(start_arr);
 				if (array_index) {
 					efree(array_index);
 				}