- CVE-2019-9023: complete the partial fix for the heap-based buffer over-reads in the mbstring regular expression functions on invalid multibyte data. Five of the seven constituent php.net bugs were already covered by Patch832 and Patch834; the two remaining ones are now backported. Bug #77370: the pattern-scanning macros PINC and PFETCH in ext/mbstring/oniguruma/regparse.c advanced p by ONIGENC_MBC_ENC_LEN(enc, p) without comparing the result against end, so a truncated multibyte lead byte at the tail of a pattern left p past the end of the buffer and fetch_token()/fetch_token_in_cc() kept reading there; clamp p back to end. Bug #77394: onigenc_unicode_mbc_case_fold() in ext/mbstring/oniguruma/enc/unicode.c advanced *pp by enclen(enc, p) with no bound, so case-insensitive mb_ereg() matching on a subject ending in a truncated multibyte tail read past end; clamp len to end - *pp - CVE-2019-9641: uninitialized read in the exif extension (php.net bug #77509). exif_process_IFD_in_TIFF() in ext/exif/exif.c validated the TIFF directory offset by adding to it before the comparison - dir_offset+2, dir_offset+dir_size and dir_offset+ifd_size were all computed first and only then checked against ImageInfo->FileSize. dir_offset comes from an attacker-controlled 32-bit TIFF field, so where size_t is 32 bits those sums wrap, the range checks pass, the following seek/read land past EOF and php_ifd_get16u() returns the still-uninitialized section buffer to the caller. The three checks are rewritten as subtractions from FileSize, which cannot overflow, and num_entries is widened to size_t before it is scaled by 12