[php-src] PR #23201: Bound the HEIF meta box allocation by the file size

Pull Request: https://github.com/php/php-src/pull/23201 Author: iliaal exif_scan_HEIF_header() takes the meta box size straight from the file and allocates it with only a lower bound of 36, so a 37-byte HEIF claiming a 128MB box forces that allocation before a single byte is read. memory_limit stops it, so this is hardening rather than a vulnerability, but the same block already bounds its second allocation by pos.size < ImageInfo->FileSize and the first one should match. ```php $ftyp = pack("N", 20) . "ftypheic" . str_repeat("\x00", 8); $meta = pack("N", 0x08000000) . "meta" . str_repeat("\x00", 8); file_put_contents("t.heic", $ftyp . $meta . "\x00"); exif_read_data("t.heic"); ``` With memory_limit=32M that is "Allowed memory size of 33554432 bytes exhausted (tried to allocate 134217720 bytes)" from a 37-byte file. PHP-8.4 has no HEIF parser, so this starts at 8.5.