Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit e6d35d8

Browse files
Fix GH-19685: Segfault when bzip2 filter has invalid parameters
1 parent bd88a54 commit e6d35d8

File tree

3 files changed

+58
-0
lines changed

3 files changed

+58
-0
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.3.26
44

5+
- Bz2:
6+
. Fixed bug GH-19685 (Segfault when bzip2 filter has invalid parameters).
7+
(alexandre-daubois)
8+
59
- Core:
610
. Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler()
711
triggers "Constant already defined" warning). (ilutov)

‎ext/bz2/bz2_filter.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,10 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
367367
zend_long blocks = zval_get_long(tmpzval);
368368
if (blocks < 1 || blocks > 9) {
369369
php_error_docref(NULL, E_WARNING, "Invalid parameter given for number of blocks to allocate (" ZEND_LONG_FMT ")", blocks);
370+
pefree(data->strm.next_in, persistent);
371+
pefree(data->strm.next_out, persistent);
372+
pefree(data, persistent);
373+
return NULL;
370374
} else {
371375
blockSize100k = (int) blocks;
372376
}
@@ -377,6 +381,10 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
377381
zend_long work = zval_get_long(tmpzval);
378382
if (work < 0 || work > 250) {
379383
php_error_docref(NULL, E_WARNING, "Invalid parameter given for work factor (" ZEND_LONG_FMT ")", work);
384+
pefree(data->strm.next_in, persistent);
385+
pefree(data->strm.next_out, persistent);
386+
pefree(data, persistent);
387+
return NULL;
380388
} else {
381389
workFactor = (int) work;
382390
}
Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
--TEST--
2+
GH-19685: bzip2.compress filter with invalid parameters should fail gracefully
3+
--EXTENSIONS--
4+
bz2
5+
--FILE--
6+
<?php
7+
$stream = fopen('php://memory', 'w+');
8+
9+
// too low
10+
$filter = stream_filter_append($stream, 'bzip2.compress', STREAM_FILTER_WRITE, array('blocks' => 0));
11+
var_dump($filter);
12+
13+
// too high
14+
$filter = stream_filter_append($stream, 'bzip2.compress', STREAM_FILTER_WRITE, array('blocks' => 10));
15+
var_dump($filter);
16+
17+
// too low work
18+
$filter = stream_filter_append($stream, 'bzip2.compress', STREAM_FILTER_WRITE, array('work' => -1));
19+
var_dump($filter);
20+
21+
// too high work
22+
$filter = stream_filter_append($stream, 'bzip2.compress', STREAM_FILTER_WRITE, array('work' => 251));
23+
var_dump($filter);
24+
25+
fclose($stream);
26+
?>
27+
--EXPECTF--
28+
Warning: stream_filter_append(): Invalid parameter given for number of blocks to allocate (0) in %s on line %d
29+
30+
Warning: stream_filter_append(): Unable to create or locate filter "bzip2.compress" in %s on line %d
31+
bool(false)
32+
33+
Warning: stream_filter_append(): Invalid parameter given for number of blocks to allocate (10) in %s on line %d
34+
35+
Warning: stream_filter_append(): Unable to create or locate filter "bzip2.compress" in %s on line %d
36+
bool(false)
37+
38+
Warning: stream_filter_append(): Invalid parameter given for work factor (-1) in %s on line %d
39+
40+
Warning: stream_filter_append(): Unable to create or locate filter "bzip2.compress" in %s on line %d
41+
bool(false)
42+
43+
Warning: stream_filter_append(): Invalid parameter given for work factor (251) in %s on line %d
44+
45+
Warning: stream_filter_append(): Unable to create or locate filter "bzip2.compress" in %s on line %d
46+
bool(false)

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /