From: Anatol Belski <ab@php.net>
Date: Tue, 16 Aug 2016 10:34:25 +0000 (+0200)
Subject: Fix bug #72837 - integer overflow in bzdecompress caused heap corruption
X-Git-Tag: php-7.1.0beta3~33^2~8^2~12
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=67d0fe39ee554563476ecae13c626580ae1a6612;p=php

Fix bug #72837 - integer overflow in bzdecompress caused heap corruption

Conflicts:
	ext/bz2/bz2.c
---

diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
index bc6379aeea..60bb71ee8d 100644
--- a/ext/bz2/bz2.c
+++ b/ext/bz2/bz2.c
@@ -594,16 +594,26 @@ static PHP_FUNCTION(bzdecompress)
 		/* compression is better then 2:1, need to allocate more memory */
 		bzs.avail_out = source_len;
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+		if (size > SIZE_MAX) {
+			/* no reason to continue if we're going to drop it anyway */
+			break;
+		}
 		dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
 		bzs.next_out = dest + size;
 	}
 
 	if (error == BZ_STREAM_END || error == BZ_OK) {
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		dest = safe_erealloc(dest, 1, (size_t) size, 1);
-		dest[size] = '\0';
-		RETVAL_STRINGL(dest, (int) size);
-		efree(dest);
+		if (size > SIZE_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %zd", SIZE_MAX);
+			efree(dest);
+			RETVAL_LONG(BZ_MEM_ERROR);
+		} else {
+			dest = safe_erealloc(dest, 1, (size_t) size, 1);
+			dest[size] = '\0';
+			RETVAL_STRINGL(dest, (size_t) size);
+			efree(dest);
+		}
 	} else { /* real error */
 		efree(dest);
 		RETVAL_LONG(error);