* SECURITY UPDATE: uninitialized read in exif_process_IFD_in_TIFF - debian/patches/php-5.6-CVE-2019-9641.patch: backport upstream commit 5e824a88d073 ("Fix integer overflows on 32-bits", PHP bug #77509) in ext/exif/exif.c. exif_process_IFD_in_TIFF() computed dir_offset+2, dir_offset+dir_size and dir_offset+ifd_size before comparing the sum against ImageInfo->FileSize. dir_offset comes from php_ifd_get32u() and is attacker-controlled up to 0xFFFFFFFF, so where size_t is 32 bits the additions wrap, the range checks pass, php_stream_seek() lands past EOF and php_stream_read() returns nothing; the 2-byte section that exif_file_sections_add() allocated with safe_emalloc() is never zeroed, so php_ifd_get16u() reads uninitialised heap memory that exif_read_data()/exif_thumbnail() can disclose. Each addition is rewritten as a subtraction from FileSize with the matching underflow guard, and num_entries is widened to size_t before being scaled by 12. - Note: byte-identical to upstream, only the hunk line numbers differ. Upstream ships no test for this commit, so none is added. The 5.6 line ended at 5.6.40 on 2019-01-10, before the 2019-03-01 fix, so no 5.6 release ever carried it; the sibling 7.1.27 EXIF fixes for #77540 and #77563/#77659 were backported in 5.6.40-9 but #77509 was skipped. - CVE-2019-9641