Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3: Fix libmagic buffer overflow issue (CVE-2019-18218) bump version set versions for release

Author: smalyshev

ext/fileinfo/libmagic/cdf.c

@@ -995,8 +995,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 goto out;
 }
 nelements = CDF_GETUINT32(q, 1);
-if (nelements == 0) {
-DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+DPRINTF(("CDF_VECTOR with nelements == %"
+ SIZE_T_FORMAT "u\n", nelements));
 goto out;
 }
 slen = 2;
@@ -1038,8 +1039,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 goto out;
 inp += nelem;
 }
-DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
- nelements));
 for (j = 0; j < nelements && i < sh.sh_properties;
  j++, i++)
 {

ext/fileinfo/libmagic/cdf.h

@@ -48,6 +48,7 @@
 typedef int32_t cdf_secid_t;
 
 #define CDF_LOOP_LIMIT10000
+#define CDF_ELEMENT_LIMIT100000
 
 #define CDF_SECID_NULL0
 #define CDF_SECID_FREE-1