Update versions for PHP 7.4.6

* PHP-7.3:
  Fix #78876: Long variables cause OOM and temp files are not cleaned
  Fix #78875: Long filenames cause OOM and temp files are not cleaned
  Update NEWS for 7.2.31
  Update CREDITS for PHP 7.2.30
  Update NEWS for PHP 7.2.30

NEWS

@@ -1,7 +1,6 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-
-?? ??? ????, PHP 7.4.6
+14 May 2020, PHP 7.4.6
 
 - Core:
   . Fixed bug #78434 (Generator yields no items after valid() call). (Nikita)
@@ -12,6 +11,10 @@ PHP                                                                        NEWS
     (cmb)
   . Fixed bug #78784 (Unable to interact with files inside a VFS for Git
     repository). (cmb)
+  . Fixed bug #78875 (Long variables cause OOM and temp files are not cleaned).
+    (cmb) (CVE-2019-11048)
+  . Fixed bug #78876 (Long variables cause OOM and temp files are not cleaned).
+    (cmb) (CVE-2019-11048)
 
 - DOM:
   . Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).
@@ -38,6 +41,10 @@ PHP                                                                        NEWS
 - Phar:
   . Fixed bug #79503 (Memory leak on duplicate metadata). (cmb)
 
+- SimpleXML:
+  . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
+    7.4.4). (cmb)
+
 - SPL:
   . Fixed bug #69264 (__debugInfo() ignored while extending SPL classes). (cmb)
   . Fixed bug #67369 (ArrayObject serialization drops the iterator class).
@@ -49,7 +56,7 @@ PHP                                                                        NEWS
   . Fixed bug #79447 (Serializing uninitialized typed properties with __sleep
     should not throw). (nicolas-grekas)
 
-?? ??? ????, PHP 7.4.5
+16 Apr 2020, PHP 7.4.5
 
 - Core:
   . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)

configure.ac

@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
 dnl ----------------------------------------------------------------------------
 
 AC_PREREQ([2.68])
-AC_INIT([PHP],[7.4.6-dev],[https://bugs.php.net],[php],[https://www.php.net])
+AC_INIT([PHP],[7.4.6],[https://bugs.php.net],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER

ext/simplexml/simplexml.c

@@ -981,7 +981,7 @@ static void _get_base_node_value(php_sxe_object *sxe_ref, xmlNodePtr node, zval
 	php_sxe_object *subnode;
 	xmlChar        *contents;
 
-	if ((!node->properties || node->type == XML_ENTITY_DECL) && node->children && node->children->type == XML_TEXT_NODE && !xmlIsBlankNode(node->children)) {
+	if (node->children && node->children->type == XML_TEXT_NODE && !xmlIsBlankNode(node->children)) {
 		contents = xmlNodeListGetString(node->doc, node->children, 1);
 		if (contents) {
 			ZVAL_STRING(value, (char *)contents);

ext/simplexml/tests/000.phpt

@@ -51,37 +51,7 @@ object(SimpleXMLElement)#%d (3) {
   ["elem1"]=>
   array(2) {
     [0]=>
-    object(SimpleXMLElement)#%d (3) {
-      ["@attributes"]=>
-      array(2) {
-        ["attr1"]=>
-        string(5) "first"
-        ["attr2"]=>
-        string(6) "second"
-      }
-      ["comment"]=>
-      object(SimpleXMLElement)#%d (0) {
-      }
-      ["elem2"]=>
-      object(SimpleXMLElement)#%d (2) {
-        ["@attributes"]=>
-        array(2) {
-          ["att25"]=>
-          string(2) "25"
-          ["att42"]=>
-          string(2) "42"
-        }
-        ["elem3"]=>
-        object(SimpleXMLElement)#%d (1) {
-          ["elem4"]=>
-          object(SimpleXMLElement)#%d (1) {
-            ["test"]=>
-            object(SimpleXMLElement)#%d (0) {
-            }
-          }
-        }
-      }
-    }
+    string(36) "There is some text.Here is some more"
     [1]=>
     object(SimpleXMLElement)#%d (1) {
       ["@attributes"]=>

ext/simplexml/tests/009b.phpt

@@ -28,29 +28,8 @@ object(SimpleXMLElement)#%d (3) {
     string(5) "elem1"
   }
   ["elem1"]=>
-  object(SimpleXMLElement)#%d (3) {
-    ["@attributes"]=>
-    array(1) {
-      ["attr1"]=>
-      string(5) "first"
-    }
-    ["comment"]=>
-    object(SimpleXMLElement)#%d (0) {
-    }
-    ["elem2"]=>
-    string(35) "
-   Here we have some text data.
-  "
-  }
+  string(10) "Bla bla 1."
   ["elem11"]=>
-  object(SimpleXMLElement)#%d (2) {
-    ["@attributes"]=>
-    array(1) {
-      ["attr2"]=>
-      string(6) "second"
-    }
-    [0]=>
-    string(10) "Bla bla 2."
-  }
+  string(10) "Bla bla 2."
 }
 ===DONE===

ext/simplexml/tests/bug51615.phpt

@@ -22,7 +22,7 @@ foreach ($html->body->span as $obj) {
 Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d
 
 Warning: DOMDocument::loadHTML(): error parsing attribute name in Entity, line: 1 in %s on line %d
-object(SimpleXMLElement)#5 (3) {
+object(SimpleXMLElement)#%d (3) {
   ["@attributes"]=>
   array(2) {
     ["title"]=>
@@ -31,29 +31,9 @@ object(SimpleXMLElement)#5 (3) {
     string(0) ""
   }
   [0]=>
-  object(SimpleXMLElement)#4 (2) {
-    ["@attributes"]=>
-    array(2) {
-      ["title"]=>
-      string(0) ""
-      ["y"]=>
-      string(0) ""
-    }
-    [0]=>
-    string(1) "x"
-  }
+  string(1) "x"
   [1]=>
-  object(SimpleXMLElement)#6 (2) {
-    ["@attributes"]=>
-    array(2) {
-      ["title"]=>
-      string(0) ""
-      ["z"]=>
-      string(0) ""
-    }
-    [0]=>
-    string(1) "x"
-  }
+  string(1) "x"
 }
 string(0) ""
 string(0) ""

ext/simplexml/tests/bug61597.phpt

@@ -1,30 +0,0 @@
---TEST--
-Bug #61597 (SXE properties may lack attributes and content)
---SKIPIF--
-<?php
-if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
-?>
---FILE--
-<?php
-$xml = <<<'EOX'
-<?xml version="1.0"?>
-<data>
-<datum file-key="8708124062829849862">corn</datum>
-</data>
-EOX;
-
-var_dump(simplexml_load_string($xml));
-?>
---EXPECTF--
-object(SimpleXMLElement)#%d (1) {
-  ["datum"]=>
-  object(SimpleXMLElement)#%d (2) {
-    ["@attributes"]=>
-    array(1) {
-      ["file-key"]=>
-      string(19) "8708124062829849862"
-    }
-    [0]=>
-    string(4) "corn"
-  }
-}

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 5
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.4.5-dev"
-#define PHP_VERSION_ID 70405
+#define PHP_RELEASE_VERSION 6
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.4.6"
+#define PHP_VERSION_ID 70406

main/rfc1867.c

@@ -606,7 +606,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
 }
 
 /* read until a boundary condition */
-static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
 {
 	size_t len, max;
 	char *bound;
@@ -645,7 +645,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 		self->buf_begin += len;
 	}
 
-	return (int)len;
+	return len;
 }
 
 /*
@@ -655,7 +655,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
 {
 	char buf[FILLUNIT], *out=NULL;
-	int total_bytes=0, read_bytes=0;
+	size_t total_bytes=0, read_bytes=0;
 
 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -682,7 +682,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *lbuf = NULL, *abuf = NULL;
 	zend_string *temp_filename = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
+	size_t array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	HashTable *uploaded_files = NULL;
@@ -1116,7 +1117,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
 
 			if (is_arr_upload) {
-				array_len = (int)strlen(start_arr);
+				array_len = strlen(start_arr);
 				if (array_index) {
 					efree(array_index);
 				}