Commit 4ee95fc2f30 for php.net
commit 4ee95fc2f30364a39afa6385abee2971e2d9a5c5
Author: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Wed Dec 31 00:06:35 2025 +0100
bz2: Fix truncation of total output size causing erroneous errors
Also switch to uint64_t as that's used on master and makes the code
simpler to fix.
Closes GH-20807.
Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>
diff --git a/NEWS b/NEWS
index cb621bd4001..a990068937e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.4.20
+- Bz2:
+ . Fix truncation of total output size causing erroneous errors. (ndossche)
+
- PCRE:
. Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl,
php_pcre_split_impl, and php_pcre_grep_impl. (David Carlier)
diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
index 583d7f475a5..e43915e1992 100644
--- a/ext/bz2/bz2.c
+++ b/ext/bz2/bz2.c
@@ -502,11 +502,7 @@ PHP_FUNCTION(bzdecompress)
size_t source_len;
int error;
bool small = 0;
-#ifdef PHP_WIN32
- unsigned __int64 size = 0;
-#else
- unsigned long long size = 0;
-#endif
+ uint64_t size = 0;
bz_stream bzs;
if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS(), "s|b", &source, &source_len, &small)) {
@@ -531,27 +527,22 @@ PHP_FUNCTION(bzdecompress)
while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {
/* compression is better then 2:1, need to allocate more memory */
bzs.avail_out = source_len;
- size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-#ifndef ZEND_ENABLE_ZVAL_LONG64
+ size = (((uint64_t) bzs.total_out_hi32) << 32U) + bzs.total_out_lo32;
if (size > SIZE_MAX) {
/* no reason to continue if we're going to drop it anyway */
break;
}
-#endif
dest = zend_string_safe_realloc(dest, 1, bzs.avail_out+1, (size_t) size, 0);
bzs.next_out = ZSTR_VAL(dest) + size;
}
if (error == BZ_STREAM_END || error == BZ_OK) {
- size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-#ifndef ZEND_ENABLE_ZVAL_LONG64
+ size = (((uint64_t) bzs.total_out_hi32) << 32U) + bzs.total_out_lo32;
if (UNEXPECTED(size > SIZE_MAX)) {
php_error_docref(NULL, E_WARNING, "Decompressed size too big, max is %zd", SIZE_MAX);
zend_string_efree(dest);
RETVAL_LONG(BZ_MEM_ERROR);
- } else
-#endif
- {
+ } else {
dest = zend_string_safe_realloc(dest, 1, (size_t)size, 1, 0);
ZSTR_LEN(dest) = (size_t)size;
ZSTR_VAL(dest)[(size_t)size] = '\0';
diff --git a/ext/bz2/tests/gh20807.phpt b/ext/bz2/tests/gh20807.phpt
new file mode 100644
index 00000000000..8d1e0cb40e4
--- /dev/null
+++ b/ext/bz2/tests/gh20807.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Truncation of total output size causing erroneous size and data
+--EXTENSIONS--
+bz2
+--INI--
+memory_limit=-1
+--SKIPIF--
+<?php
+if (!getenv('RUN_RESOURCE_HEAVY_TESTS')) die('skip resource-heavy test');
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+if (PHP_OS === 'FreeBSD') die('skip Worker does not handle OOM gracefully');
+if (PHP_INT_SIZE !== 8) die('skip Only for 64-bit systems');
+?>
+--FILE--
+<?php
+var_dump(sha1(bzdecompress(base64_decode("QlpoOTFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1not6YPAV+OCADAAAAIIAAwgE1GQqAlqQqAlzFBWSZTWei3pg8BX44IAMAAAAggADCATUZCoCWpCoCXMUFZJlNZ6LemDwFfjggAwAAACCAAMIBNRkKgJakKgJcxQVkmU1kuvJCFAIpSiADgBAAIIABwM00E1SepopKSrpQIKdEKSTZKIArRSUlXCFJJ8xQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWe1u+jQBX44IAKAAAAggADCATUZCoCWpCoCXMUFZJlNZ7W76NAFfjggAoAAACCAAMIBNRkKgJakKgJcxQVkmU1ntbvo0AV+OCACgAAAIIAAwgE1GQqAlqQqAlzFBWSZTWTNWeUMBFKWIALAEAAggAGoKUAUqPTiiRIYRVSqLAlSRtRUgViiRIehKkjzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1njBR55AV+OCACQAAAIIAAwgE1GQqAlqQqAlzFBWSZTWeMFHnkBX44IAJAAAAggADCATUZCoCWpCoCXMUFZJlNZ4wUeeQFfjggAkAAACCAAMIBNRkKgJakKgJcxQVkmU1mtxU0XAD9qCACYBAAIIABwM00ClJ6mklKq6qqFVOqEAjYUoClpJSquEQCPmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKazzbiEhAK/HBABEAAAEEAAYQCajIVAS1IVAS5igrJMprPNuISEAr8cEAEQAAAQQABhAJqMhUBLUhUBLmKCskyms824hIQCvxwQARAAABBAAGEAmoyFQEtSFQEuYoKyTKayOlbYVgGTehABGAgAEEAA4GaaCapPUxBFKcqFISuVSElbRQlVGIIpTpUhJXzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ/9LW4wFfjggAhAAACCAAMIBNRkKgJakKgJcxQVkmU1n/0tbjAV+OCACEAAAIIAAwgE1GQqAlqQqAlzFBWSZTWf/S1uMBX44IAIQAAAggADCATUZCoCWpCoCXMUFZJlNZ9EMghAFUEAgAhgQACCAAUGaaBSk9TQQJJ1CgqqupVSmxKohoIEk4qqU+YoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskyms/QXFbACvxwQAQQAABBAAGEAmoyFQEtSFQEuYoKyTKaz9BcVsAK/HBABBAAAEEAAYQCajIVAS1IVAS5igrJMprP0FxWwAr8cEAEEAAAQQABhAJqMhUBLUhUBLmKCskymsiUnBUgA/akQAQYIABBAAOBmmgmqT1NJIgdAKgXShKqNlEqVJaSRA4oSqj5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms+jA3SoCvxwQAQIAABBAAGEAmoyFQEtSFQEuYoKyTKaz6MDdKgK/HBABAgAAEEAAYQCajIVAS1IVAS5igrJMprPowN0qAr8cEAECAAAQQABhAJqMhUBLUhUBLmKCskyms4qxPEQCEk8QAQMIABBAAOBmmgUpPUwSIg4KpShcUUUm1RRQGCREHSiik+YoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskyms+NyZVwCvxwQAQEAABBAAGEAmoyFQEtSFQEuYoKyTKaz43JlXAK/HBABAQAAEEAAYQCajIVAS1IVAS5igrJMprPjcmVcAr8cEAEBAAAQQABhAJqMhUBLUhUBLmKCskymswVrRDAAZ9gQAQEIABBAAGGYE1TTVECm1KIFPF3JFOFCQLW69vQ"))));
+?>
+--EXPECT--
+string(40) "d4b5e52ed34a774fa645f94369b0c61375436d30"