Fixed bug #63377 (Segfault on output buffer)

NEWS

@@ -12,6 +12,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #63451 (config.guess file does not have AIX 7 defined, 
     shared objects are not created). (kemcline at au1 dot ibm dot com)
+  . Fixed bug #63377 (Segfault on output buffer).
+    (miau dot jp at gmail dot com, Laruence)
 
 - Apache2 Handler SAPI:
   . Enabled Apache 2.4 configure option for Windows (Pierre, Anatoliy)

main/output.c

@@ -607,7 +607,7 @@ PHPAPI int php_ob_handler_used(char *handler_name TSRMLS_DC)
 static inline void php_ob_append(const char *text, uint text_length TSRMLS_DC)
 {
 	char *target;
-	int original_ob_text_length;
+	uint original_ob_text_length;
 
 	original_ob_text_length=OG(active_ob_buffer).text_length;
 

tests/output/bug63377.phpt

@@ -0,0 +1,58 @@
+--TEST--
+Bug #63377 (Segfault on output buffer > 2GB)
+--SKIPF--
+<?php
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+// check the available memory
+if (PHP_OS == 'Linux') {
+  $lines = file('/proc/meminfo');
+  $infos = array();
+  foreach ($lines as $line) {
+    $tmp = explode(":", $line);
+    $index = strtolower($tmp[0]);
+    $value = (int)ltrim($tmp[1], " ")*1024;
+    $infos[$index] = $value;
+  }
+  $freeMemory = $infos['memfree']+$infos['buffers']+$infos['cached'];
+  if ($freeMemory < 2100*1024*1024) {
+    die('skip Not enough memory.');
+  }
+}
+elseif (PHP_OS == 'FreeBSD') {
+  $lines = explode("\n",`sysctl -a`);
+  $infos = array();
+  foreach ($lines as $line) {
+    if(!$line){
+      continue;
+    }
+    $tmp = explode(":", $line);
+    $index = strtolower($tmp[0]);
+    $value = trim($tmp[1], " ");
+    $infos[$index] = $value;
+  }
+  $freeMemory = ($infos['vm.stats.vm.v_inactive_count']*$infos['hw.pagesize'])
+                +($infos['vm.stats.vm.v_cache_count']*$infos['hw.pagesize'])
+                +($infos['vm.stats.vm.v_free_count']*$infos['hw.pagesize']);
+  if ($freeMemory < 2100*1024*1024) {
+    die('skip Not enough memory.');
+  }
+}
+?>
+--FILE--
+<?php
+ini_set('memory_limit', '3072M');
+
+ob_start();
+for ($i = 0; $i < 22; $i++)  {
+        echo str_repeat('a', 100 * 1024 * 1024);
+}
+ob_end_clean();
+echo "okey";
+?>
+--EXPECTF--
+okey