set versions

There is a difference between TS and NTS warning message, since
virtual_mkdir vs glibc directly is used. This has no effect for
the actual fix functionality.

NEWS

@@ -1,22 +1,37 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-09 Jun 2016 PHP 7.0.8RC1
+23 Jun 2016 PHP 7.0.8
 
 - Core:
-  . Fixed bug #72221 (segfault, past-the-end access). (Lauri Kenttä)
   . Fixed bug #72218 (If host name cannot be resolved then PHP 7 crashes). 
     (Esminis at esminis dot lt)
+  . Fixed bug #72221 (segfault, past-the-end access). (Lauri Kenttä)
+  . Fixed bug #72268 (Integer Overflow in nl2br()). (Stas)
+  . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/
+    json_utf8_to_utf16()). (Stas)
+  . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Stas)
+  . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL). (Stas)
 
 - FPM:
   . Fixed bug #72308 (fastcgi_finish_request and logging environment
     variables). (Laruence)
 
 - GD:
+  . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas)
   . Fixed bug #72337 (invalid dimensions can lead to crash) (Pierre)
+  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in 
+    heap overflow). (Pierre)
+  . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)
 
 - Intl:
   . Fixed bug #64524 (Add intl.use_exceptions to php.ini-*). (Anatol)
 
+- mbstring:
+  . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (Stas)
+
+- mcrypt:
+   . Fixed bug #72455 (Heap Overflow due to integer overflows). (Stas)
+
 - PCRE:
   . Fixed bug #72143 (preg_replace uses int instead of size_t). (Joe)
 
@@ -33,14 +48,19 @@ PHP                                                                        NEWS
   . Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free). (Laruence)
   . Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol)
 
+- SPL:
+  . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (Stas)
+  . Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and
+    unserialize). (Dmitry)
+
 - Standard:
-  . Fixed bug #72300 (ignore_user_abort(false) has no effect). (Laruence)
-  . Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
-    (Laruence)
-  . Fixed bug #72193 (dns_get_record returns array containing elements of
-    type 'unknown'). (Laruence)
   . Fixed bug #72017 (range() with float step produces unexpected result).
     (Thomas Punt)
+  . Fixed bug #72193 (dns_get_record returns array containing elements of
+    type 'unknown'). (Laruence)
+  . Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
+    (Laruence)
+  . Fixed bug #72300 (ignore_user_abort(false) has no effect). (Laruence)
 
 - XML:
   . Fixed bug #72206 (xml_parser_create/xml_parser_free leaks mem). (Joe)
@@ -49,9 +69,14 @@ PHP                                                                        NEWS
   . Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type).
     (Joe, Laruence)
 
+- WDDX:
+  . Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (Stas)
+
 - Zip:
   . Fixed ug #72258 (ZipArchive converts filenames to unrecoverable form).
     (Anatol)
+  . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC
+    algorithm and unserialize). (Dmitry)
 
 26 May 2016 PHP 7.0.7
 

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
 PHP_RELEASE_VERSION=8
-PHP_EXTRA_VERSION="RC1"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/gd/tests/bug72339.phpt

@@ -3,7 +3,29 @@ Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
 --SKIPIF--
 <?php if (!function_exists("imagecreatefromgd2")) print "skip"; ?>
 --FILE--
-<?php imagecreatefromgd2(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd"); ?>
+<?php
+$fname = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd";
+
+$fh = fopen($fname, "w");
+fwrite($fh, "gd2\x00");
+fwrite($fh, pack("n", 2));
+fwrite($fh, pack("n", 1));
+fwrite($fh, pack("n", 1));
+fwrite($fh, pack("n", 0x40));
+fwrite($fh, pack("n", 2));
+fwrite($fh, pack("n", 0x5AA0)); // Chunks Wide
+fwrite($fh, pack("n", 0x5B00)); // Chunks Vertically
+fwrite($fh, str_repeat("\x41\x41\x41\x41", 0x1000000)); // overflow data
+fclose($fh);
+
+$im = imagecreatefromgd2($fname);
+
+if ($im) {
+	imagedestroy($im);
+}
+unlink($fname);
+
+?>
 --EXPECTF--	
 Warning: imagecreatefromgd2(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
  in %sbug72339.php on line %d

ext/phar/tests/bug72321.phpt

@@ -21,6 +21,6 @@ DONE
 rmdir(__DIR__."/test72321");
 ?>
 --EXPECTF--
-Warning: PharData::extractTo(): Not a directory in %s/bug72321.php on line %d
-Extraction from phar "%s/72321_2.zip" failed: Cannot extract "AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/b/c", could not create directory "test72321/AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/b"
-DONE
+Warning: PharData::extractTo(): %s in %sbug72321.php on line %d
+Extraction from phar "%s72321_2.zip" failed: Cannot extract "AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/b/c", could not create directory "test72321/AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/b"
+DONE

ext/standard/tests/strings/bug72433.phpt

@@ -21,12 +21,39 @@ var_dump($free_me);
 --EXPECTF--
 array(3) {
   [0]=>
-  *RECURSION*
+  array(3) {
+    [0]=>
+    *RECURSION*
+    [1]=>
+    *RECURSION*
+    [2]=>
+    object(ArrayObject)#%d (1) {
+      ["storage":"ArrayObject":private]=>
+      *RECURSION*
+    }
+  }
   [1]=>
-  *RECURSION*
+  array(3) {
+    [0]=>
+    *RECURSION*
+    [1]=>
+    *RECURSION*
+    [2]=>
+    object(ArrayObject)#%d (1) {
+      ["storage":"ArrayObject":private]=>
+      *RECURSION*
+    }
+  }
   [2]=>
   object(ArrayObject)#%d (1) {
     ["storage":"ArrayObject":private]=>
-    *RECURSION*
+    array(3) {
+      [0]=>
+      *RECURSION*
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
   }
 }

ext/standard/tests/strings/bug72434.phpt

@@ -26,8 +26,8 @@ $fill_freed_space_4 = "filler_zval_4";
 debug_zval_dump($unserialized_payload[1]);
 ?>
 --EXPECTF--
-array(1) refcount(1){
+array(1) refcount(3){
   [0]=>
-  object(stdClass)#%d (0) refcount(3){
+  object(stdClass)#%d (0) refcount(1){
   }
 }

ext/wddx/wddx.c

@@ -784,6 +784,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 
 		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp((char *)atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
+				if (stack->varname) efree(stack->varname);
 				stack->varname = estrdup((char *)atts[i]);
 				break;
 			}

ext/zip/php_zip.h

@@ -37,7 +37,7 @@ extern zend_module_entry zip_module_entry;
 #define ZIP_OVERWRITE ZIP_TRUNCATE
 #endif
 
-#define PHP_ZIP_VERSION "1.13.2"
+#define PHP_ZIP_VERSION "1.13.3"
 
 #ifndef  Z_SET_REFCOUNT_P
 # if PHP_MAJOR_VERSION < 6 && (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 3)

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 0
 #define PHP_RELEASE_VERSION 8
-#define PHP_EXTRA_VERSION "RC1"
-#define PHP_VERSION "7.0.8RC1"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.0.8"
 #define PHP_VERSION_ID 70008