Commit c68ede953aa for php.net
commit c68ede953aaf84d70036881dbec4fd4044d51667
Merge: 114c0d6e930 9248a6c70e3
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date: Fri Feb 27 23:49:46 2026 +0100
Merge branch 'PHP-8.5'
* PHP-8.5:
bz2: Fix truncation of total output size causing erroneous errors
diff --cc ext/bz2/bz2.c
index a8153d7d119,a7af4b1a03a..91e694f58f4
--- a/ext/bz2/bz2.c
+++ b/ext/bz2/bz2.c
@@@ -537,8 -537,8 +537,8 @@@ PHP_FUNCTION(bzdecompress
while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {
/* compression is better then 2:1, need to allocate more memory */
bzs.avail_out = source_len;
- size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+ size = (((uint64_t) bzs.total_out_hi32) << 32U) + bzs.total_out_lo32;
- if (size > SIZE_MAX) {
+ if (UNEXPECTED(size > SIZE_MAX)) {
/* no reason to continue if we're going to drop it anyway */
break;
}
@@@ -548,9 -547,9 +547,9 @@@
}
if (error == BZ_STREAM_END || error == BZ_OK) {
- size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+ size = (((uint64_t) bzs.total_out_hi32) << 32U) + bzs.total_out_lo32;
if (UNEXPECTED(size > SIZE_MAX)) {
- php_error_docref(NULL, E_WARNING, "Decompressed size too big, max is %zd", SIZE_MAX);
+ php_error_docref(NULL, E_WARNING, "Decompressed size too big, max is %zu", SIZE_MAX);
zend_string_efree(dest);
RETVAL_LONG(BZ_MEM_ERROR);
} else {