clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 09:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix GH-15034: Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB
This commit is contained in:
Niels Dossche 2024-07-21 22:02:47 +02:00
commit c26d1a36e2
No known key found for this signature in database
GPG Key ID: B8A8AD166DF0E2E5
3 changed files with 59 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -16,6 +16,8 @@ PHP NEWS
- Streams:
. Fixed bug GH-15028 (Memory leak in ext/phar/stream.c). (nielsdos)
. Fixed bug GH-15034 (Integer overflow on stream_notification_callback
byte_max parameter with files bigger than 2GB). (nielsdos)
- Tidy:
. Fix memory leaks in ext/tidy basedir restriction code. (nielsdos)

15
ext/standard/http_fopen_wrapper.c
View File

@ -792,8 +792,19 @@ finish:
} else if (!strncasecmp(http_header_line, "Content-Type:", sizeof("Content-Type:")-1)) {
php_stream_notify_info(context, PHP_STREAM_NOTIFY_MIME_TYPE_IS, http_header_value, 0);
} else if (!strncasecmp(http_header_line, "Content-Length:", sizeof("Content-Length:")-1)) {
file_size = atoi(http_header_value);
php_stream_notify_file_size(context, file_size, http_header_line, 0);
/* https://www.rfc-editor.org/rfc/rfc9110.html#name-content-length */
const char *ptr = http_header_value;
/* must contain only digits, no + or - symbols */
if (*ptr >= '0' && *ptr <= '9') {
char *endptr = NULL;
size_t parsed = ZEND_STRTOUL(ptr, &endptr, 10);
/* check whether there was no garbage in the header value and the conversion was successful */
if (endptr && !*endptr) {
/* truncate for 32-bit such that no negative file sizes occur */
file_size = MIN(parsed, ZEND_LONG_MAX);
php_stream_notify_file_size(context, file_size, http_header_line, 0);
}
}
} else if (
!strncasecmp(http_header_line, "Transfer-Encoding:", sizeof("Transfer-Encoding:")-1)
&& !strncasecmp(http_header_value, "Chunked", sizeof("Chunked")-1)

44
ext/standard/tests/http/gh15034.phpt Normal file
View File

@ -0,0 +1,44 @@
--TEST--
GH-15034 (Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB)
--SKIPIF--
<?php
require 'server.inc';
http_server_skipif();
if (PHP_INT_SIZE != 8) die("skip 64-bit only");
?>
--INI--
allow_url_fopen=1
--FILE--
<?php
require 'server.inc';
$responses = [
"data://text/plain,HTTP/1.1 200 OK\r\n"
. "Content-Type: text/plain\r\n"
. "Content-Length: 3000000000\r\n\r\n"
. "foo\n",
];
['pid' => $pid, 'uri' => $uri] = http_server($responses);
$params = ['notification' => function(
int $notification_code,
int $severity,
?string $message,
int $message_code,
int $bytes_transferred,
int $bytes_max
) {
global $max;
$max = $bytes_max;
}];
$contextResource = stream_context_create([], $params);
$resource = fopen($uri, 'r', false, $contextResource);
fclose($resource);
http_server_kill($pid);
var_dump($max);
?>
--EXPECT--
int(3000000000)