Description:
------------
I've just stumbled upon <https://bugs.php.net/bug.php?id=64823>
and that pointed me to a potential security issue, namely that the
open_basedir check[1] is useless for font names (which are looked
up in the standard font directories). Even worse, not only a font
name, but actually a semicolon delimited font name list[2] is
accepted by gdImageStringFT() and friends, what is not catered to
by the PHP binding at all, i.e. the reproduce script works in non
ZTS mode (if myfont.ttf exists in the parent dir), even if
`open_basedir=.`.

[1] <https://github.com/php/php-src/blob/PHP-7.0.11/ext/gd/gd.c#L3914>
[2] <https://github.com/php/php-src/blob/PHP-7.0.11/ext/gd/libgd/gdft.c#L81-L85>


Test script:
---------------
var_dump(
	imagettfbbox(14, 0, 'doesnotexist.tff;../myfont.ttf', 'foo')
	=== false
);


Expected result:
----------------
Warning: fopen(): open_basedir restriction in effect. File(../myfont.ttf) is not within the allowed path(s): (.) in %s on line %d
bool(true)


Actual result:
--------------
bool(false)