* SECURITY UPDATE: heap buffer over-read in the convert.* stream filters - debian/patches/php-7.1-CVE-2026-92842.patch: backport upstream commit b4e3397ec8 in ext/standard/filters.c. The base64-encode, quoted-printable-encode and quoted-printable-decode constructors copied line-break-chars with the strlen()-based pestrdup() but kept the caller's length, so a value containing a NUL byte was truncated and the filter later read lbchars_len bytes past the end of the shorter copy. They now use pestrndup() with the real length. Adds the upstream regression test. - CVE-2026-92842 * SECURITY UPDATE: integer overflow in the SOAP client HTTP body reader - debian/patches/php-7.1-CVE-2025-14181.patch: backport upstream commit b11bd1d939 in ext/soap/php_http.c. get_http_body() accumulated chunked body sizes in a signed int and guarded growth with "http_buf_size + buf_size + 1 < 0", which overflow makes undefined and which a compiler may drop, so a server sending large chunk sizes could shrink the reallocation and make the following read overflow the heap buffer. The accumulator is now size_t, the chunk size is unsigned, each growth step is bounded by ZSTR_MAX_LEN and done with zend_string_safe_realloc(), the Connection: close reader is bounded the same way, and the relative redirect path is built with safe_emalloc(). Adds the upstream regression test, adapted to stream its 2 GiB response instead of building it in memory. - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection - debian/patches/php-7.1-CVE-2026-6103.patch: backport upstream commit 0994e2e887 in ext/phar/tar.c and ext/phar/phar_internal.h. Entry sizes were parsed with an unchecked octal accumulator that silently wrapped, stopped at the first non-octal byte and ignored GNU base-256 sizes, and only regular files had their data blocks skipped, so attacker controlled data could be parsed as the next tar header and inject an entry other tar readers never see. Sizes that cannot be parsed or represented are now rejected, every entry type that carries data has it skipped, GNU long link records are refused, and a ././@LongLink name longer than the archive is rejected. Adds the three upstream regression tests. - CVE-2026-6103 * SECURITY UPDATE: unbounded recursion in ext/soap XML parsing and decoding - debian/patches/php-7.1-CVE-2026-91765.patch: backport upstream commit 3655b79c7b in ext/soap/php_xml.c, php_encoding.c, php_soap.h and soap.c. A deeply nested SOAP request or WSDL, or a long chain or cycle of href references, recursed without limit in cleanup_xml_node(), get_node_with_attribute_recursive_ex() and the decoder, and crashed the process on stack exhaustion. The two tree walkers are now iterative, documents deeper than 2048 levels are rejected on libxml2 older than 2.13 (newer libxml2 enforces this itself), and decoding fails with "Encoding: Nesting level too deep" past 4096 nested values. Adds the three upstream regression tests. - CVE-2026-91765