fix #40189 (possible endless loop in zlib.inflate stream filter)

diff --git a/ext/bz2/bz2_filter.c b/ext/bz2/bz2_filter.c
index 5c0010f9558f453de49188291c580f74f8067afb..cc42b162a199958c260528abafcd79203a95bd50 100644 (file)
--- a/ext/bz2/bz2_filter.c
+++ b/ext/bz2/bz2_filter.c
@@ -108,6 +108,11 @@ static php_stream_filter_status_t php_bz2_decompress_filter(
                        consumed += desired;
                        bin += desired;
 
+                       if (!desired) {
+                               flags |= PSFS_FLAG_FLUSH_CLOSE;
+                               break;
+                       }
+
                        if (data->strm.avail_out < data->outbuf_len) {
                                php_stream_bucket *out_bucket;
                                size_t bucketlen = data->outbuf_len - data->strm.avail_out;

diff --git a/ext/zlib/zlib_filter.c b/ext/zlib/zlib_filter.c
index b24a4c36e40d65120f2f819621e4e6160d68d352..a292b348e5046e9e211ab735ff53715b3ed4ce4e 100644 (file)
--- a/ext/zlib/zlib_filter.c
+++ b/ext/zlib/zlib_filter.c
@@ -106,6 +106,11 @@ static php_stream_filter_status_t php_zlib_inflate_filter(
                        data->strm.avail_in = 0;
                        bin += desired;
 
+                       if (!desired) {
+                               flags |= PSFS_FLAG_FLUSH_CLOSE;
+                               break;
+                       }
+
                        if (data->strm.avail_out < data->outbuf_len) {
                                php_stream_bucket *out_bucket;
                                size_t bucketlen = data->outbuf_len - data->strm.avail_out;