Merge branch 'PHP-8.3' into PHP-8.4

Author: devnexen

NEWS

@@ -11,6 +11,9 @@ PHP                                                                        NEWS
 - Curl:
   . Fixed bug GH-16723 (CURLMOPT_PUSHFUNCTION issues). (cmb)
 
+- GD:
+  . Fixed GH-16776 (imagecreatefromstring overflow). (David Carlier)
+
 - Hash:
   . Fixed GH-16711: Segfault in mhash(). (Girgias)
 

ext/gd/gd.c

@@ -1366,7 +1366,7 @@ static int _php_ctx_getmbi(gdIOCtx *ctx)
 
 	do {
 		i = (ctx->getC)(ctx);
-		if (i < 0) {
+		if (i < 0 || mbi > (INT_MAX >> 7)) {
 			return -1;
 		}
 		mbi = (mbi << 7) | (i & 0x7f);

ext/gd/tests/gh16771.phpt

@@ -0,0 +1,10 @@
+--TEST--
+GH-16771 (UBSan abort in ext/gd/libgd/gd.c:1372)
+--EXTENSIONS--
+gd
+--FILE--
+<?php
+$string_mb = base64_decode('5pel5pys6Kqe44OG44Kt44K544OIMzTvvJXvvJbml6XmnKzoqp7jg4bjgq3jgrnjg4g=');
+imagecreatefromstring($string_mb);
+--EXPECTF--
+Warning: imagecreatefromstring(): Data is not in a recognized format in %s on line %d