* CVE-2019-9641: integer overflows in ext/exif on 32-bit - exif_process_IFD_in_TIFF() added the directory size (and the thumbnail size) to the offset before comparing it against the file size, so a crafted TIFF could wrap the sum and pass the check; the additions are now rewritten as subtractions that cannot overflow * CVE-2017-8923: integer overflow in string concatenation - the ZEND_CONCAT handler and its nine specialisations computed len + ZSTR_LEN(op2_str) without checking it against ZSTR_MAX_LEN before reallocating, so concatenating huge strings wrapped the length and undersized the allocation; the sum is now checked and a fatal error raised instead. The .= operator goes through concat_function(), which already carries its own guard * CVE-2025-1736: header suppression in the http:// stream wrapper - php_stream_url_wrap_http_ex() detected user-supplied headers by looking back for any of CR, LF, tab or space, so a header value containing a bare LF (or a tab/space) before a header name made PHP believe the caller had already supplied that header and silently drop its own. The look-back now requires a full CRLF sequence at the seven have_header sites, which gate an addition and so fail safe. The eighth site, which strips Proxy-Authorization before a CONNECT tunnel, gates a removal and is left unchanged: tightening it there would fail open and replay the proxy credential to the origin * CVE-2025-1735: missing escaping error checks in ext/pgsql and ext/pdo_pgsql - PQescapeStringConn(), PQescapeByteaConn() and PQescapeIdentifier() failures were ignored and the unescaped buffer used to build the query; the reachable call sites now check the error status and propagate the failure. Upstream's two regression tests are carried verbatim