[pull] master from php:master

ext/gd/gd.c

@@ -3931,9 +3931,17 @@ PHP_FUNCTION(imagescale)
 		src_y = gdImageSY(im);
 
 		if (src_x && tmp_h < 0) {
+			if (tmp_w > (ZEND_LONG_MAX / src_y)) {
+				zend_argument_value_error(2, "must be less than or equal to " ZEND_LONG_FMT, (zend_long)(ZEND_LONG_MAX / src_y));
+				RETURN_THROWS();
+			}
 			tmp_h = tmp_w * src_y / src_x;
 		}
 		if (src_y && tmp_w < 0) {
+			if (tmp_h > (ZEND_LONG_MAX / src_x)) {
+				zend_argument_value_error(3, "must be less than or equal to " ZEND_LONG_FMT, (zend_long)(ZEND_LONG_MAX / src_x));
+				RETURN_THROWS();
+			}
 			tmp_w = tmp_h * src_x / src_y;
 		}
 	}

ext/gd/tests/gh20602.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-20551: (imagegammacorrect out of range input/output value)
+--EXTENSIONS--
+gd
+--FILE--
+<?php
+$im = imagecreatetruecolor(16, 16);
+
+try {
+	imagescale($im, PHP_INT_MAX, -1);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+try {
+	imagescale($im, -1, PHP_INT_MAX);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+?>
+--EXPECTF--
+imagescale(): Argument #2 ($width) must be less than or equal to %d
+imagescale(): Argument #3 ($height) must be less than or equal to %d

ext/phar/phar.c

@@ -1149,15 +1149,9 @@ static zend_result phar_parse_pharfile(php_stream *fp, char *fname, size_t fname
 		PHAR_GET_32(buffer, entry.uncompressed_filesize);
 		PHAR_GET_32(buffer, entry.timestamp);
 
-		if (offset == halt_offset + manifest_len + 4) {
-			mydata->min_timestamp = entry.timestamp;
+		if (offset == halt_offset + manifest_len + 4
+		 || mydata->max_timestamp < entry.timestamp) {
 			mydata->max_timestamp = entry.timestamp;
-		} else {
-			if (mydata->min_timestamp > entry.timestamp) {
-				mydata->min_timestamp = entry.timestamp;
-			} else if (mydata->max_timestamp < entry.timestamp) {
-				mydata->max_timestamp = entry.timestamp;
-			}
 		}
 
 		PHAR_GET_32(buffer, entry.compressed_filesize);

ext/phar/phar_internal.h

@@ -258,7 +258,6 @@ struct _phar_archive_data {
 	/* hash of mounted directory paths */
 	HashTable                mounted_dirs;
 	uint32_t                 flags;
-	uint32_t                 min_timestamp;
 	uint32_t                 max_timestamp;
 	int                      refcount;
 	php_stream               *fp;

ext/phar/phar_object.c

@@ -1622,8 +1622,6 @@ static int phar_build(zend_object_iterator *iter, void *puser) /* {{{ */
 		data->internal_file->offset_abs = data->internal_file->offset = php_stream_tell(p_obj->fp);
 		data->fp = NULL;
 		php_stream_copy_to_stream_ex(fp, p_obj->fp, PHP_STREAM_COPY_ALL, &contents_len);
-		data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
-			php_stream_tell(p_obj->fp) - data->internal_file->offset;
 		if (php_stream_stat(fp, &ssb) != -1) {
 			data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
 		} else {

ext/spl/spl_directory.c

@@ -480,9 +480,8 @@ static spl_filesystem_object *spl_filesystem_object_create_info(zend_string *fil
 	RETVAL_OBJ(&intern->std);
 
 	if (ce->constructor->common.scope != spl_ce_SplFileInfo) {
-		ZVAL_STR_COPY(&arg1, file_path);
+		ZVAL_STR(&arg1, file_path);
 		zend_call_method_with_1_params(Z_OBJ_P(return_value), ce, &ce->constructor, "__construct", NULL, &arg1);
-		zval_ptr_dtor(&arg1);
 	} else {
 		spl_filesystem_info_set_filename(intern, file_path);
 	}
@@ -520,9 +519,8 @@ static spl_filesystem_object *spl_filesystem_object_create_type(int num_args, sp
 			}
 
 			if (ce->constructor->common.scope != spl_ce_SplFileInfo) {
-				ZVAL_STR_COPY(&arg1, source->file_name);
+				ZVAL_STR(&arg1, source->file_name);
 				zend_call_method_with_1_params(Z_OBJ_P(return_value), ce, &ce->constructor, "__construct", NULL, &arg1);
-				zval_ptr_dtor(&arg1);
 			} else {
 				intern->file_name = zend_string_copy(source->file_name);
 				intern->path = spl_filesystem_object_get_path(source);
@@ -549,11 +547,9 @@ static spl_filesystem_object *spl_filesystem_object_create_type(int num_args, sp
 			}
 
 			if (ce->constructor->common.scope != spl_ce_SplFileObject) {
-				ZVAL_STR_COPY(&arg1, source->file_name);
-				ZVAL_STR_COPY(&arg2, open_mode);
+				ZVAL_STR(&arg1, source->file_name);
+				ZVAL_STR(&arg2, open_mode);
 				zend_call_method_with_2_params(Z_OBJ_P(return_value), ce, &ce->constructor, "__construct", NULL, &arg1, &arg2);
-				zval_ptr_dtor(&arg1);
-				zval_ptr_dtor(&arg2);
 			} else {
 				intern->file_name = source->file_name;
 				intern->path = spl_filesystem_object_get_path(source);