Fix ZEND_LONG_UINT_OVFL() accepting negative values on 32-bit platforms (#24778)

Where zend_long is not wider than an int, ZEND_LONG_UINT_OVFL() was
defined as 0, so a negative value passed the check there, while it is
rejected where zend_long is wider. Keep checking the lower bound on these
platforms too.

This affects mbstring.regex_stack_limit, mbstring.regex_retry_limit and
the codepage of sapi_windows_cp_set() and sapi_windows_cp_conv().

Author: marc-mabe

NEWS

@@ -139,6 +139,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
   . Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead
     byte at the end of a multipart field name. (Jorg Sowa)
+  . Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit
+    on 32bit platforms. (Marc Bennewitz)
 
 - MySQLnd:
   . Fixed bug GH-24293 (Segfault on connect with an empty password to a
@@ -333,6 +335,8 @@ PHP                                                                        NEWS
     tidy::repairFile() rejecting null for $encoding. (lacatoire)
 
 - Windows:
+  . Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative
+    codepage on 32bit platforms. (Marc Bennewitz)
   . Fixed bug GH-25009 (GetConsoleTitleW() buffer size passed in bytes).
     (Lazizbek Ergashev)
 

Zend/zend_range_check.h

@@ -47,7 +47,7 @@
 # define ZEND_LONG_INT_OVFL(zl) (0)
 # define ZEND_LONG_INT_UDFL(zl) (0)
 # define ZEND_LONG_EXCEEDS_INT(zlong) (0)
-# define ZEND_LONG_UINT_OVFL(zl) (0)
+# define ZEND_LONG_UINT_OVFL(zl) UNEXPECTED((zl) < 0)
 #endif
 
 /* size_t vs (unsigned) int checks. */

ext/mbstring/tests/retry_limit_negative.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Oniguruma retry limit is not set from a negative mbstring.regex_retry_limit
+--EXTENSIONS--
+mbstring
+--SKIPIF--
+<?php
+if (!function_exists('mb_ereg')) die('skip mb_ereg not available');
+if (@version_compare(MB_ONIGURUMA_VERSION, '6.9.3') < 0) {
+    die('skip requires Oniguruma >= 6.9.3');
+}
+?>
+--INI--
+error_reporting=E_ALL & ~E_DEPRECATED
+mbstring.regex_retry_limit=-1
+--FILE--
+<?php
+/* A negative limit must leave the default of Oniguruma in place, rather than
+ * being converted to an unsigned int of UINT_MAX. This match needs more
+ * retries than the default allows for. */
+$regex = 'A(B|C+)+D|AC+X';
+$str = 'A' . str_repeat('C', 24) . 'X';
+var_dump(mb_ereg($regex, $str));
+?>
+--EXPECT--
+bool(false)

ext/standard/tests/strings/sapi_windows_cp_negative_codepage.phpt

@@ -0,0 +1,37 @@
+--TEST--
+sapi_windows_cp_set() and sapi_windows_cp_conv() must reject a negative codepage
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Windows') die('skip for Windows only');
+?>
+--FILE--
+<?php
+try {
+    sapi_windows_cp_set(-1);
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_set(PHP_INT_MIN);
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_conv(-1, 65001, 'php');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_conv(65001, -1, 'php');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+ValueError: sapi_windows_cp_set(): Argument #1 ($codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_set(): Argument #1 ($codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_conv(): Argument #1 ($in_codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_conv(): Argument #2 ($out_codepage) must be between 0 and 4294967295