Fix uninitalized variables reads. See CWE-457 for more info.

[MegaManSec]

No description provided.

[smalyshev]

Any tests/reproductions for these fixes?

[MegaManSec]

No.

I assume if you run the command 100 times and compare the results, you might get different data.
But in reality, it is hard to trigger. It's really just "undefined behavior", which in the past has led to exploits.

Thanks,

[yohgaki]

Isn't this line is better to be
zuv.import_use_extension_length = sizeof(".php") - 1;

We use sizeof("str") - 1, cases like this.

[MegaManSec]

The reason I did what I did, is because the only other usage of zuv.iport_use_extension also uses the strlen:

./Zend/zend.c:800: zend_uv.import_use_extension_length = (uint)strlen(zend_uv.import_use_extension);

Up to you/devs as to how it should be done, though.

[yohgaki]

Nice work!
Note for UPGRADING would be appreciated.

[MegaManSec]

@yohgaki I don't know what to put in UPGRADING file, sorry.