[pull] master from php:master

.github/workflows/test-suite.yml

@@ -919,6 +919,7 @@ jobs:
         with:
           ref: ${{ fromJson(inputs.branch).ref }}
           fetch-depth: 0
+          filter: blob:none
       # ASLR can cause a lot of noise due to missed sse opportunities for memcpy
       # and other operations, so we disable it during benchmarking.
       - name: Disable ASLR

NEWS

@@ -39,6 +39,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested
     Dom\XMLDocument). (Lazizbek Ergashev)
 
+- Exif:
+  . Fixed exif_read_data() allocating a HEIF meta box larger than the file
+    it came from. (iliaal)
+
 - GMP:
   . Added optional $definitely_prime output parameter to gmp_prevprime().
     (Weilin Du)

docs/source/miscellaneous/writing-tests.rst

@@ -596,9 +596,10 @@ Example 1 (full): :ref:`sample001.phpt`
 on the first line. If the test was part of a TestFest event, then # followed by the name of the
 event and the date (YYYY-MM-DD) on the second line.
 
-**Required:** No. For newly created tests this section should no longer be included, as test
-authorship is already accurately tracked by Git. If multiple authors should be credited, the
-`Co-authored-by` tag in the commit message may be used.
+**Required:** No. For newly created tests the section should no longer be used for simple authorship
+claims or listing all contributors who edited the test; as it is already accurately tracked by Git.
+It may be used if more specific attribution is useful, for example to credit the original reporter
+of a bug or a contributor who is not credited via `Co-authored-by` tag.
 
 **Format:** Name Email [Event]
 

ext/exif/exif.c

@@ -4412,7 +4412,7 @@ static bool exif_scan_HEIF_header(image_info_type *ImageInfo, unsigned char *buf
 		}
 		if (box.type == FOURCC("meta")) {
 			limit = box.size - box_header_size;
-			if (limit < 36) {
+			if (limit < 36 || limit > ImageInfo->FileSize) {
 				break;
 			}
 			data = (unsigned char *)emalloc(limit);

ext/exif/tests/heic_meta_box_alloc.phpt

@@ -0,0 +1,23 @@
+--TEST--
+HEIC meta box size must be bounded by the file size
+--EXTENSIONS--
+exif
+--INI--
+memory_limit=32M
+--FILE--
+<?php
+// ftyp box (size 20) followed by a meta box whose size field claims 128MB,
+// in a file that is only 37 bytes. Without an upper bound the meta box
+// allocation exhausts memory_limit before any read is attempted.
+$ftyp = pack("N", 20) . "ftypheic" . str_repeat("\x00", 8);
+$meta = pack("N", 0x08000000) . "meta" . str_repeat("\x00", 8);
+file_put_contents(__DIR__."/heic_meta_box_alloc.heic", $ftyp . $meta . "\x00");
+var_dump(exif_read_data(__DIR__."/heic_meta_box_alloc.heic"));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__."/heic_meta_box_alloc.heic");
+?>
+--EXPECTF--
+Warning: exif_read_data(): Invalid HEIF file in %s on line %d
+bool(false)

ext/opcache/ZendAccelerator.c

@@ -4742,11 +4742,11 @@ static void preload_load(size_t orig_map_ptr_static_last)
 	size_t old_map_ptr_last = CG(map_ptr_last);
 	if (zend_map_ptr_static_last != ZCSG(map_ptr_static_last) || old_map_ptr_last != ZCSG(map_ptr_last)) {
 		CG(map_ptr_last) = ZCSG(map_ptr_last);
-		CG(map_ptr_size) = ZEND_MM_ALIGNED_SIZE_EX(ZCSG(map_ptr_last) + 1, 4096);
+		CG(map_ptr_size) = ZEND_MM_ALIGNED_SIZE_EX(ZCSG(map_ptr_last) + 1, ZEND_MAP_PTR_CHUNK_SIZE);
 		zend_map_ptr_static_last = ZCSG(map_ptr_static_last);
 
 		/* Grow map_ptr table as needed, but allocate once for static + regular map_ptrs */
-		size_t new_static_size = ZEND_MM_ALIGNED_SIZE_EX(zend_map_ptr_static_last, 4096);
+		size_t new_static_size = ZEND_MM_ALIGNED_SIZE_EX(zend_map_ptr_static_last, ZEND_MAP_PTR_CHUNK_SIZE);
 		if (zend_map_ptr_static_size != new_static_size) {
 			void *new_base = pemalloc((new_static_size + CG(map_ptr_size)) * sizeof(void *), 1);
 			if (CG(map_ptr_real_base)) {