Prepare for 7.3.21

We have to check for NUL bytes if `getimagesize()` has been called.

(cherry picked from commit ff577b04c0)

NEWS

@@ -1,12 +1,14 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.21
+06 Aug 2020, PHP 7.3.21
 
 - Apache:
   . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time
     to return usec). (Herbert256)
 
 - Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
   . Fixed bug #79778 (Assertion failure if dumping closure with unresolved
     static variable). (Nikita)
   . Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
@@ -30,13 +32,17 @@ PHP                                                                        NEWS
 - Mbstring:
   . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang)
 
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
 - Standard:
   . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb)
   . Fixed bug #79817 (str_replace() does not handle INDIRECT elements). (Nikita)
   . Fixed bug #78008 (dns_check_record() always return true on Alpine).
     (Andy Postnikov)
 
-?? ??? ????, PHP 7.3.20
+09 Jul 2020, PHP 7.3.20
 
 - Core:
   . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb)

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.21-dev"
+#define ZEND_VERSION "3.3.21"
 
 #define ZEND_ENGINE_3
 

configure.ac

@@ -108,7 +108,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=21
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/phar/tests/bug79797.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #79797 (Use of freed hash key in the phar_parse_zipfile function)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension not available');
+?>
+--INI--
+phar.cache_list={PWD}/bug79797.phar
+--FILE--
+<?php
+echo "done\n";
+?>
+--EXPECT--
+done

ext/phar/zip.c

@@ -705,7 +705,7 @@ foundit:
 			efree(actual_alias);
 		}
 
-		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), actual_alias, mydata->alias_len, mydata);
+		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), mydata->alias, mydata->alias_len, mydata);
 	} else {
 		phar_archive_data *fd_ptr;
 

ext/standard/image.c

@@ -1496,6 +1496,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
 		Z_PARAM_ZVAL_DEREF(info)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
+		php_error_docref(NULL, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (argc == 2) {
 		zval_ptr_dtor(info);
 		array_init(info);

ext/standard/tests/image/bug79877.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #79877 (getimagesize function silently truncates after a null byte)
+--FILE--
+<?php
+var_dump(getimagesize("/tmp/a.png\0xx"));
+?>
+--EXPECTF--
+Warning: getimagesize(): Invalid path in %s on line %d
+NULL

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 21
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.3.21-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.3.21"
 #define PHP_VERSION_ID 70321