Raise compiler warning on octal overflow

Addresses https://bugs.php.net/bug.php?id=71994

NEWS

@@ -31,6 +31,7 @@ PHP                                                                        NEWS
     respect scientific notation in numeric strings. (Andrea)
   . Implemented the RFC `Catching multiple exception types`. (Bronislaw Bialek,
     Pierrick)
+  . Raise a compile-time warning on octal escape sequence overflow. (Sara)
 
 - FTP:
   . Implemented FR #55651 (Option to ignore the returned FTP PASV address).

Zend/tests/oct_overflow_char.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Octal overflow in string interpolation
+--FILE--
+<?php
+
+// "abc", ordinarily 'b' would be \142, but we'll deliberately overflow the value by \400
+echo "\141\542\143\n";
+--EXPECTF--
+Warning: Octal escape sequence overflow \542 is greater than \377 in %s/oct_overflow_char.php on line 4
+abc

Zend/zend_language_scanner.l

@@ -1044,6 +1044,12 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 								Z_STRLEN_P(zendlval)--;
 							}
 						}
+						if (octal_buf[2] &&
+						    (octal_buf[0] > '3')) {
+							/* 3 octit values must not overflow 0xFF (\377) */
+							zend_error(E_COMPILE_WARNING, "Octal escape sequence overflow \\%s is greater than \\377", octal_buf);
+						}
+
 						*t++ = (char) ZEND_STRTOL(octal_buf, NULL, 8);
 					} else {
 						*t++ = '\\';