From 44f564c32105e2f9601a2e9c219d19238945c9ec Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Tue, 11 Aug 2026 17:06:28 +0800 Subject: [PATCH 1/4] ext/opcache: Name map ptr chunk size constants (#23212) This is a missing case of #23109 --- ext/opcache/ZendAccelerator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c index 8685fb564150..cf62765d9e1d 100644 --- a/ext/opcache/ZendAccelerator.c +++ b/ext/opcache/ZendAccelerator.c @@ -4742,11 +4742,11 @@ static void preload_load(size_t orig_map_ptr_static_last) size_t old_map_ptr_last = CG(map_ptr_last); if (zend_map_ptr_static_last != ZCSG(map_ptr_static_last) || old_map_ptr_last != ZCSG(map_ptr_last)) { CG(map_ptr_last) = ZCSG(map_ptr_last); - CG(map_ptr_size) = ZEND_MM_ALIGNED_SIZE_EX(ZCSG(map_ptr_last) + 1, 4096); + CG(map_ptr_size) = ZEND_MM_ALIGNED_SIZE_EX(ZCSG(map_ptr_last) + 1, ZEND_MAP_PTR_CHUNK_SIZE); zend_map_ptr_static_last = ZCSG(map_ptr_static_last); /* Grow map_ptr table as needed, but allocate once for static + regular map_ptrs */ - size_t new_static_size = ZEND_MM_ALIGNED_SIZE_EX(zend_map_ptr_static_last, 4096); + size_t new_static_size = ZEND_MM_ALIGNED_SIZE_EX(zend_map_ptr_static_last, ZEND_MAP_PTR_CHUNK_SIZE); if (zend_map_ptr_static_size != new_static_size) { void *new_base = pemalloc((new_static_size + CG(map_ptr_size)) * sizeof(void *), 1); if (CG(map_ptr_real_base)) { From 8a90e02f1516b9db18791cd7ea2d9b21e7f64d9f Mon Sep 17 00:00:00 2001 From: NickSdot <32384907+NickSdot@users.noreply.github.com> Date: Tue, 11 Aug 2026 16:55:30 +0700 Subject: [PATCH 2/4] perf: speed up benchmark checkout (#23211) --- .github/workflows/test-suite.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test-suite.yml b/.github/workflows/test-suite.yml index 2046a3d816c8..b444caf6b820 100644 --- a/.github/workflows/test-suite.yml +++ b/.github/workflows/test-suite.yml @@ -919,6 +919,7 @@ jobs: with: ref: ${{ fromJson(inputs.branch).ref }} fetch-depth: 0 + filter: blob:none # ASLR can cause a lot of noise due to missed sse opportunities for memcpy # and other operations, so we disable it during benchmarking. - name: Disable ASLR From 1f1570906ea65e5bc479ed9b9ec5d6510230406e Mon Sep 17 00:00:00 2001 From: NickSdot <32384907+NickSdot@users.noreply.github.com> Date: Tue, 11 Aug 2026 17:06:12 +0700 Subject: [PATCH 3/4] docs: Clarify `--CREDITS--` section (GH-23215) --- docs/source/miscellaneous/writing-tests.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/source/miscellaneous/writing-tests.rst b/docs/source/miscellaneous/writing-tests.rst index 4339e042e6a4..40e273b6fd71 100644 --- a/docs/source/miscellaneous/writing-tests.rst +++ b/docs/source/miscellaneous/writing-tests.rst @@ -596,9 +596,10 @@ Example 1 (full): :ref:`sample001.phpt` on the first line. If the test was part of a TestFest event, then # followed by the name of the event and the date (YYYY-MM-DD) on the second line. -**Required:** No. For newly created tests this section should no longer be included, as test -authorship is already accurately tracked by Git. If multiple authors should be credited, the -`Co-authored-by` tag in the commit message may be used. +**Required:** No. For newly created tests the section should no longer be used for simple authorship +claims or listing all contributors who edited the test; as it is already accurately tracked by Git. +It may be used if more specific attribution is useful, for example to credit the original reporter +of a bug or a contributor who is not credited via `Co-authored-by` tag. **Format:** Name Email [Event] From 82ac0da470086295313e977c26243b2e726afd7b Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Mon, 10 Aug 2026 10:31:50 -0400 Subject: [PATCH 4/4] Bound the HEIF meta box allocation by the file size exif_scan_HEIF_header() allocated box.size - box_header_size with only a lower bound, so a 37-byte file could claim a 128MB meta box and force the allocation before any read is attempted. The second allocation in the same block is already bounded by pos.size < ImageInfo->FileSize; apply the same bound to the first. Closes GH-23201 --- NEWS | 4 ++++ ext/exif/exif.c | 2 +- ext/exif/tests/heic_meta_box_alloc.phpt | 23 +++++++++++++++++++++++ 3 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 ext/exif/tests/heic_meta_box_alloc.phpt diff --git a/NEWS b/NEWS index 299678d0a008..ffc76ae4a64b 100644 --- a/NEWS +++ b/NEWS @@ -20,6 +20,10 @@ PHP NEWS . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes with DOMNode::isEqualNode()). (Weilin Du) +- Exif: + . Fixed exif_read_data() allocating a HEIF meta box larger than the file + it came from. (iliaal) + - Intl: . Fixed IntlListFormatter::__construct() leaving stale global error state after successful calls. (Weilin Du) diff --git a/ext/exif/exif.c b/ext/exif/exif.c index b30644f155cf..a2eb8259ac71 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -4415,7 +4415,7 @@ static bool exif_scan_HEIF_header(image_info_type *ImageInfo, unsigned char *buf } if (box.type == FOURCC("meta")) { limit = box.size - box_header_size; - if (limit < 36) { + if (limit < 36 || limit > ImageInfo->FileSize) { break; } data = (unsigned char *)emalloc(limit); diff --git a/ext/exif/tests/heic_meta_box_alloc.phpt b/ext/exif/tests/heic_meta_box_alloc.phpt new file mode 100644 index 000000000000..ddc9e415b830 --- /dev/null +++ b/ext/exif/tests/heic_meta_box_alloc.phpt @@ -0,0 +1,23 @@ +--TEST-- +HEIC meta box size must be bounded by the file size +--EXTENSIONS-- +exif +--INI-- +memory_limit=32M +--FILE-- + +--CLEAN-- + +--EXPECTF-- +Warning: exif_read_data(heic_meta_box_alloc.heic): Invalid HEIF file in %s on line %d +bool(false)