php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4' into PHP-8.5

Browse Source 
* PHP-8.4:
  Fix GH-20620: bzcompress() overflow on large source size.
This commit is contained in:
David Carlier
2025-12-05 22:32:28 +00:00
parent e910bbf144 83b36de67d
commit d9032b376f
2 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ext/bz2/bz2.c
View File

@@ -476,8 +476,15 @@ PHP_FUNCTION(bzcompress)
+ .01 x length of data + 600 which is the largest size the results of the compression
could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net
for pointing this out). */
// TODO Check source string length fits in unsigned int
dest_len = (unsigned int) (source_len + (0.01 * source_len) + 600);
size_t chunk_len = source_len + source_len / 100 + 600;
const size_t min = MIN(ZSTR_MAX_LEN, UINT_MAX);
if (chunk_len < source_len || chunk_len > min) {
zend_argument_value_error(1, "must have a length less than or equal to %zu", min);
RETURN_THROWS();
}
dest_len = (unsigned int) chunk_len;
/* Allocate the destination buffer */
dest = zend_string_alloc(dest_len, 0);

21
ext/bz2/tests/gh20620.phpt Normal file
View File

@@ -0,0 +1,21 @@
--TEST--
Bug GH-20620 (bzcompress with large source)
--EXTENSIONS--
bz2
--SKIPIF--
<?php
if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only');
if (getenv('SKIP_SLOW_TESTS')) die('skip slow tests excluded by request');
?>
--INI--
memory_limit=-1
--FILE--
<?php
try {
bzcompress(str_repeat('1', 4295163906));
} catch (\ValueError $e) {
echo $e->getMessage(), PHP_EOL;
}
?>
--EXPECTF--
bzcompress(): Argument #1 ($data) must have a length less than or equal to %d