Commit 4f983146688 for php.net

commit 4f98314668803036e61dede05d12ae44b20ff19d
Merge: 1f1570906ea 82ac0da4700
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Aug 11 07:21:17 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Bound the HEIF meta box allocation by the file size

diff --cc NEWS
index df22c2cea46,ffc76ae4a64..1ed1362f355
--- a/NEWS
+++ b/NEWS
@@@ -38,40 -15,41 +38,44 @@@ PH
      DOMDocument). (Lazizbek Ergashev)
    . Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested
      Dom\XMLDocument). (Lazizbek Ergashev)
 -  . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
 -    declares a default value for the attribute). (iliaal)
 -  . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
 -    with DOMNode::isEqualNode()). (Weilin Du)

+ - Exif:
+   . Fixed exif_read_data() allocating a HEIF meta box larger than the file
+     it came from. (iliaal)
+
 +- GMP:
 +  . Added optional $definitely_prime output parameter to gmp_prevprime().
 +    (Weilin Du)
 +  . Added gmp_powm_sec(). (Weilin Du)
 +
  - Intl:
 +  . Added static methods IntlDatePatternGenerator::getSkeleton() and
 +    IntlDatePatternGenerator::getBaseSkeleton(). (Weilin Du)
 +  . Fixed Collator::sort(), collator_sort(), Collator::asort(), and
 +    collator_asort() to report UTF-8/UTF-16 conversion errors through the intl
 +    error handler instead of emitting a warning and continuing with an empty
 +    string. (Weilin Du)
    . Fixed IntlListFormatter::__construct() leaving stale global error state
      after successful calls. (Weilin Du)
 -
 -- Opcache:
 -  . Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
 +  . Fixed IntlNumberRangeFormatter leaving stale global error state after
 +    successful createFromSkeleton() and format() calls. (Weilin Du)
 +  . Implemented GH-20255 (Add a predefined calendar constant in
 +    IntlDateFormatter for the proleptic gregorian calendar). (David Carlier)
 +  . Added SpoofChecker::areBidiConfusable(). (David Carlier)
 +  . Added SpoofChecker::getBidiSkeleton(). (Weilin Du)
 +  . Added SpoofChecker::getSkeleton(). (David Carlier)
 +  . Fixed IntlNumberRangeFormatter::format() crash when the formatting fails.
      (David Carlier)
 -  . Fixed bug GH-22763 (JIT fails to clear ZREG_TYPE_ONLY after setting reg).
 -    (Arnaud)
 -  . Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on
 -    a property hook getter, losing register-held variables). (Zhao Hao)
 -  . Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).
 -    (Arnaud)

 -- OpenSSL:
 -  . Fix missing error check on invalid alpn protocols. (ndossche)
 +- MbString:
 +  . Passing objects to mb_convert_variables() is now deprecated. (Girgias)

 -- MBString:
 -  . Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative
 -    offset in a non-UTF-8 encoding). (Eyüp Can Akman)
 -  . Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi()
 -    invalidates the regex cache). (Matthias Goergens)
 +- MySQLi:
 +  . The mysqli_get_charset() function is now deprecated. (Kamil Tekiela)

 -- PCRE:
 -  . Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is
 -    now forbidden. (Arnaud)
 +- PDO:
 +  . Fixed pdo_raise_impl_error() emitting a warning under ERRMODE_SILENT.
 +    (iliaal)

  - PDO_ODBC:
    . Fixed bug GH-23016 (NULL values in long columns come back as garbage
diff --cc ext/exif/tests/heic_meta_box_alloc.phpt
index 00000000000,ddc9e415b83..0a07d4c29bf
mode 000000,100644..100644
--- a/ext/exif/tests/heic_meta_box_alloc.phpt
+++ b/ext/exif/tests/heic_meta_box_alloc.phpt
@@@ -1,0 -1,23 +1,23 @@@
+ --TEST--
+ HEIC meta box size must be bounded by the file size
+ --EXTENSIONS--
+ exif
+ --INI--
+ memory_limit=32M
+ --FILE--
+ <?php
+ // ftyp box (size 20) followed by a meta box whose size field claims 128MB,
+ // in a file that is only 37 bytes. Without an upper bound the meta box
+ // allocation exhausts memory_limit before any read is attempted.
+ $ftyp = pack("N", 20) . "ftypheic" . str_repeat("\x00", 8);
+ $meta = pack("N", 0x08000000) . "meta" . str_repeat("\x00", 8);
+ file_put_contents(__DIR__."/heic_meta_box_alloc.heic", $ftyp . $meta . "\x00");
+ var_dump(exif_read_data(__DIR__."/heic_meta_box_alloc.heic"));
+ ?>
+ --CLEAN--
+ <?php
+ @unlink(__DIR__."/heic_meta_box_alloc.heic");
+ ?>
+ --EXPECTF--
 -Warning: exif_read_data(heic_meta_box_alloc.heic): Invalid HEIF file in %s on line %d
++Warning: exif_read_data(): Invalid HEIF file in %s on line %d
+ bool(false)