head	1.1;
access;
symbols;
locks; strict;
comment	@ * @;


1.1
date	2026.10.22.02.06.45;	author taca;	state Exp;
branches;
next	;
commitid	Wi6Qo1a7ewgzMp0H;


desc
@@


1.1
log
@lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619

Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub.

Quote from security advisory announce on https://www.php.net:

Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.

Bump PKGREVISION.
@
text
@$NetBSD$

Fix for CVE-2026-109618-109619.

--- Zend/zend_multiply.h.orig	2022-10-31 10:36:16.000000000 +0000
+++ Zend/zend_multiply.h
@@@@ -321,7 +321,7 @@@@ static zend_always_inline size_t zend_sa
 	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
 
 	if (UNEXPECTED(overflow)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
 	}
 	return ret;
@@@@ -334,7 +334,7 @@@@ static zend_always_inline size_t zend_sa
 	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
 
 	if (UNEXPECTED(overflow)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
+		zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
 		return 0;
 	}
 	return ret;
@