[php-src] PR #25200: Fix HEIF EXIF extraction with variable-width iloc entries

Pull Request: https://github.com/php/php-src/pull/25200 Author: jorge-zopitech # Draft pull request - NOT SUBMITTED Title: Fix HEIF EXIF extraction with variable-width iloc entries Author: Jorge Moya A. - ZopiTech GitHub: jorge-zopitech Git commit email: jorge.moya@zopitech.cl Target: php/php-src master Source: jorge-zopitech:fix/exif-heif-iloc-variable-width Commit: 0d7c9a6056707746ae64b3dec47b81519c3e55c6 ## Summary PHP's EXIF HEIF parser assumes a fixed 16-byte stride for iloc item records even though the box specifies variable widths for the offset, length and base-offset fields. Valid HEIC files may therefore fail to return Exif metadata via exif_read_data(). This change parses the declared field widths and extent_count, performs bounded reads and integer overflow checks, and handles iloc preceding iinf. The parser intentionally supports only single-extent, local-file EXIF items when the result fits its current offset and length representation. ## Reproduction An HEIC file encoded with libheif/x265 and tagged using ExifTool is recognized by heif-info and ExifTool but PHP 8.5.12 returns false from exif_read_data(). With this change, the same file returns IFD0 Make and Model. ## Tests - 319 test fixtures, each run on original, bounds-only and patched PHP 8.5.12 builds: 957 isolated executions. No ASan/UBSan reports. - 4 HEIC images encoded with x265: the patched parser extracts Make/Model from all 4; original PHP extracts none. - An official PHPT regression test fails against the unpatched PHP 8.5.12 build and passes on the patched build. - Built php-src master as PHP 8.7.0-dev, NTS DEBUG, ASan/UBSan. - Official EXIF test suite from master: 108 tests total, 104 passed, 4 skipped, 0 failures. - The new heic_variable_iloc.phpt passes on patched master. ## Scope This fixes HEIF/HEIC EXIF compatibility. No RCE, corruption of memory or vulnerability has been demonstrated. Multi-extent and non-local construction methods are not covered. ## Notes for reviewers Please review the bounded parsing and supported iloc versions (v0/v1/v2), including base offsets, extent counts and unusual box ordering. The fixture files are locally generated, without personal photographs or metadata. Signed-off-by: Jorge Moya A. <jorge.moya@zopitech.cl>