Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327

This amends commit 8f4a537, which aimed to correct NULL dereference because of
missing check of gdImageCreateTrueColor() / gdImageCreate() return value.  That
commit checks for negative crop rectangle width and height, but
gdImageCreate*() can also return NULL when width * height overflows.  Hence
NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy()
is called before dst == NULL check.

This moves NULL check to happen right after gdImageCreate*().  It also removes
width and height check before gdImageCreate*(), as the same check is done by
image create functions (with an extra warning).

From thoger redhat com
NEWS
Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  NEWS
  Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
Merge branch 'PHP-5.6'

* PHP-5.6:
  NEWS
  Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
NEWS
Merge branch 'master' of git.php.net:php-src

# By krakjoe (558) and others
# Via Anatol Belski (126) and others
* 'master' of git.php.net:php-src: (1484 commits)
  NEWS
  NEWS
  Fixed Bug #66820 out-of-bounds memory access in fileinfo
  Improves fix for memory leak, keep in sync with upstream.
  Add notice about tsrm_virtual_cwd.h moved to zend_virtual_cwd.h as this introduce need for awfull hacks...
  Fixed NEWS for #60602
  Fixed news for #60602
  Updated news for #60602
  proc_open(): separate environment values that aren't strings
  Added DateTimeImmutable::createFromMutable.
  Sort alphabetically
  Fixed NEWS.
  Capture peer cert even if verify fails
  Windows cert verify improvements + leak fixes
  turn off some false positives
  support for static analyzers other than visual studio
  fix wording
  reveal more info on the configure options
  Updated news for #66535 and #66109
  Updated news for #66535 and #66109
  ...
Merge branch 'PHP-5.6'

* PHP-5.6:
  NEWS
Refactor the result set data structures. Move more to the buffered and unbuffered
substructures. Add methods to these too. Preparing for pluggable interface for
returning data to the engine (zvals, c-style, something else)
Merge branch 'PHP-5.6'
Abort on invalid IV size

Previously, if the size of the IV did not match the block size
mcrypt would throw a warning and fall back to a NUL IV. This
behavior is both dangerous and makes no practical sense.

mcrypt_encrypt etc. will now return false if the IV has an incorrect
size.
Abort on missing IV if the enc_mode requires it

Previously the code fell back on using a NUL IV if no IV was
passed and the encryption mode required it. This is dangerous and
makes no sense from a practical point of view (as you could just
as well use ECB then).
Abort on invalid key size

Previously an incorrectly sized key was either silently padded
with NUL bytes or truncated. Especially the silent nature of this
behavior makes it extremely easy to use weak encryption. A common
mistake - which has also been extensively made in our tests - is
to use a password instead of a key.

Incorrectly sized keys will now be rejected.
Clean up do_crypt code

Avoid unnecessary alloc/copy/free cycles and clean up structure in
general. Add a few extra checks for the key length.
Print supported key sizes in error message
Call mcrypt_module_close on error
Provide expected IV length in IV error messages
Remove a number of macros that are no longer used
Use zpp for accepting encryption mode string

Leaving the non-zpp usage for the mcrypt_{MODE} functions, as
they're deprecated and I'm too lazy to update all their tests.
Add NEWS entry for mcrypt changes
Merge branch 'PHP-5.6'