diff options
| author | Antony Dovgal <tony2001@php.net> | 2007-01-25 12:22:21 +0000 |
|---|---|---|
| committer | Antony Dovgal <tony2001@php.net> | 2007-01-25 12:22:21 +0000 |
| commit | 0bc0e57b855c7b8c3919fd2cb944b13ea0565d48 (patch) | |
| tree | f55c09d7240af8ff73661895b889de1f32e081f2 | |
| parent | de3c2038af4870a340c770c56511c4f239128999 (diff) | |
| download | php-git-0bc0e57b855c7b8c3919fd2cb944b13ea0565d48.tar.gz | |
MFH: fix #40189 (possible endless loop in zlib.inflate stream filter)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/bz2/bz2_filter.c | 5 | ||||
| -rw-r--r-- | ext/zlib/zlib_filter.c | 10 |
3 files changed, 17 insertions, 0 deletions
@@ -7,6 +7,8 @@ PHP NEWS thread safe version). (Dmitry) - Fixed bug #40191 (use of array_unique() with objects triggers segfault). (Tony) +- Fixed bug #40189 (possible endless loop in zlib.inflate stream filter). + (Greg, Tony) - Fixed bug #40169 (CURLOPT_TCP_NODELAY only available in curl >= 7.11.2). (Tony) - Fixed bug #40092 (chroot() doesn't clear realpath cache). (Dmitry) diff --git a/ext/bz2/bz2_filter.c b/ext/bz2/bz2_filter.c index 9cdd5f019f..e29346e567 100644 --- a/ext/bz2/bz2_filter.c +++ b/ext/bz2/bz2_filter.c @@ -101,6 +101,11 @@ static php_stream_filter_status_t php_bz2_decompress_filter( consumed += desired; bin += desired; + if (!desired) { + flags |= PSFS_FLAG_FLUSH_CLOSE; + break; + } + if (data->strm.avail_out < data->outbuf_len) { php_stream_bucket *out_bucket; size_t bucketlen = data->outbuf_len - data->strm.avail_out; diff --git a/ext/zlib/zlib_filter.c b/ext/zlib/zlib_filter.c index 240da21646..1fa090f86c 100644 --- a/ext/zlib/zlib_filter.c +++ b/ext/zlib/zlib_filter.c @@ -100,6 +100,11 @@ static php_stream_filter_status_t php_zlib_inflate_filter( consumed += desired; bin += desired; + if (!desired) { + flags |= PSFS_FLAG_FLUSH_CLOSE; + break; + } + if (data->strm.avail_out < data->outbuf_len) { php_stream_bucket *out_bucket; size_t bucketlen = data->outbuf_len - data->strm.avail_out; @@ -208,6 +213,11 @@ static php_stream_filter_status_t php_zlib_deflate_filter( consumed += desired; bin += desired; + if (!desired) { + flags |= PSFS_FLAG_FLUSH_CLOSE; + break; + } + if (data->strm.avail_out < data->outbuf_len) { php_stream_bucket *out_bucket; size_t bucketlen = data->outbuf_len - data->strm.avail_out; |