diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-07-18 23:01:10 -0700 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-07-19 15:57:51 +0200 |
| commit | 1b6e8e5d74df7937a2ffaa3e02732f0544b4f88e (patch) | |
| tree | 5f4357890685cf6eadff54e6e0bf529c38dd0c77 | |
| parent | 5b48472ec3446035decc0f86999bba038f14b51d (diff) | |
| download | php-git-1b6e8e5d74df7937a2ffaa3e02732f0544b4f88e.tar.gz | |
Partial fix for bug #72613 - do not allow reading past error read
(cherry picked from commit 5faa15c4ce9d68a286a9ffe10ecbb897ebe95601)
| -rw-r--r-- | ext/bz2/bz2.c | 6 | ||||
| -rw-r--r-- | ext/bz2/tests/72613.bz2 | bin | 0 -> 351 bytes | |||
| -rw-r--r-- | ext/bz2/tests/bug72613.phpt | 23 |
3 files changed, 28 insertions, 1 deletions
diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c index 359425437d..bc6379aeea 100644 --- a/ext/bz2/bz2.c +++ b/ext/bz2/bz2.c @@ -148,7 +148,11 @@ static size_t php_bz2iop_read(php_stream *stream, char *buf, size_t count) just_read = BZ2_bzread(self->bz_file, buf, to_read); if (just_read < 1) { - stream->eof = 0 == just_read; + /* it is not safe to keep reading after an error, see #72613 */ + stream->eof = 1; + if (just_read < 0) { + return -1; + } break; } diff --git a/ext/bz2/tests/72613.bz2 b/ext/bz2/tests/72613.bz2 Binary files differnew file mode 100644 index 0000000000..0b932f8d91 --- /dev/null +++ b/ext/bz2/tests/72613.bz2 diff --git a/ext/bz2/tests/bug72613.phpt b/ext/bz2/tests/bug72613.phpt new file mode 100644 index 0000000000..82547e6ae0 --- /dev/null +++ b/ext/bz2/tests/bug72613.phpt @@ -0,0 +1,23 @@ +--TEST-- +Bug #72613 (Inadequate error handling in bzread()) +--SKIPIF-- +<?php if (!extension_loaded("bz2")) print "skip"; ?> +--FILE-- +<?php +$fp = bzopen(__DIR__.'/72613.bz2', 'r'); +if ($fp === FALSE) { + exit("ERROR: bzopen()"); +} +$data = ""; +while (!feof($fp)) { + $res = bzread($fp); + if ($res === FALSE) { + exit("ERROR: bzread()"); + } + $data .= $res; +} +bzclose($fp); +?> +DONE +--EXPECT-- +DONE
\ No newline at end of file |