Heap-data disclosure via unadvanced chunk buffer pointer

Out-of-bounds reads in PHP allow remote attackers to disclose heap data through multi-chunk image parsing by getimagesize(). php_read_stream_all_chunks() repeatedly writes each input chunk at the buffer start, reports the buffer fully populated, and returns uninitialized tail bytes in APPn metadata. Exploitation requires attacker-controlled image input and knowledge of the stream chunk size; disclosed data is limited to heap contents returned with image metadata.