Fix ZEND_LONG_UINT_OVFL() accepting negative values on 32-bit platforms

NEWS

@@ -87,6 +87,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
   . Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead
     byte at the end of a multipart field name. (Jorg Sowa)
+  . Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit
+    on 32bit platforms. (Marc Bennewitz)
 
 - MySQLnd:
   . Fixed bug GH-24293 (Segfault on connect with an empty password to a
@@ -201,6 +203,10 @@ PHP                                                                        NEWS
   . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and
     tidy::repairFile() rejecting null for $encoding. (lacatoire)
 
+- Windows:
+  . Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative
+    codepage on 32bit platforms. (Marc Bennewitz)
+
 - Zip:
   . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
     configuration. (Weilin Du)

Zend/zend_range_check.h

@@ -47,7 +47,7 @@
 # define ZEND_LONG_INT_OVFL(zl) (0)
 # define ZEND_LONG_INT_UDFL(zl) (0)
 # define ZEND_LONG_EXCEEDS_INT(zlong) (0)
-# define ZEND_LONG_UINT_OVFL(zl) (0)
+# define ZEND_LONG_UINT_OVFL(zl) UNEXPECTED((zl) < 0)
 #endif
 
 /* size_t vs (unsigned) int checks. */

ext/mbstring/tests/retry_limit_negative.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Oniguruma retry limit is not set from a negative mbstring.regex_retry_limit
+--EXTENSIONS--
+mbstring
+--SKIPIF--
+<?php
+if (!function_exists('mb_ereg')) die('skip mb_ereg not available');
+if (@version_compare(MB_ONIGURUMA_VERSION, '6.9.3') < 0) {
+    die('skip requires Oniguruma >= 6.9.3');
+}
+?>
+--INI--
+error_reporting=E_ALL & ~E_DEPRECATED
+mbstring.regex_retry_limit=-1
+--FILE--
+<?php
+/* A negative limit must leave the default of Oniguruma in place, rather than
+ * being converted to an unsigned int of UINT_MAX. This match needs more
+ * retries than the default allows for. */
+$regex = 'A(B|C+)+D|AC+X';
+$str = 'A' . str_repeat('C', 24) . 'X';
+var_dump(mb_ereg($regex, $str));
+?>
+--EXPECT--
+bool(false)

ext/standard/tests/strings/sapi_windows_cp_negative_codepage.phpt

@@ -0,0 +1,37 @@
+--TEST--
+sapi_windows_cp_set() and sapi_windows_cp_conv() must reject a negative codepage
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Windows') die('skip for Windows only');
+?>
+--FILE--
+<?php
+try {
+    sapi_windows_cp_set(-1);
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_set(PHP_INT_MIN);
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_conv(-1, 65001, 'php');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+try {
+    sapi_windows_cp_conv(65001, -1, 'php');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+ValueError: sapi_windows_cp_set(): Argument #1 ($codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_set(): Argument #1 ($codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_conv(): Argument #1 ($in_codepage) must be between 0 and 4294967295
+ValueError: sapi_windows_cp_conv(): Argument #2 ($out_codepage) must be between 0 and 4294967295