Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:38875
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.46.29 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=from:to:subject:date:user-agent:mime-version:content-type
         :content-transfer-encoding:content-disposition:message-id;
        b=V8vj8uDn3wuLAyncuWEY0zPVS30vCYTmd6H7rkWJKqfJE/vb+WHSt0SnJqEY4zq4yr
         LlmzUsZVNm3yv81IhxoMzIuQAbRgMmkGw4s6liP62b8GfnEefClMIaeGT6+PpShrvXXL
         fbNzgQljw0thTqoD66YAXXko4HRESNJBzd0bY=
To: PHP Internals List <internals@lists.php.net>
Date: Wed, 9 Jul 2008 15:58:47 +0200
User-Agent: KMail/1.9.9
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-ID: <200807091558.47262.arnaud.lb@gmail.com>
Subject: [PATH] bug#42663: gzinflate() try to allocate all memory
From: arnaud.lb@gmail.com ("Arnaud Le Blanc")

Hi,

I made a patch [1] for a bug I reported some times ago [2].

gzinflate() passes the Z_FINISH flag to inflate(). This flag may be used when 
the length of the decoded data is known, so that the data is decoded in one 
pass.
When gzinflate() do not know the decoded length, it grows the buffer and try 
again while inflate() returns Z_BUF_ERROR. 

The problem is that Z_FINISH causes inflate() to also return Z_BUF_ERROR when 
the encoded data is truncated or corrupted, which may cause an infinite loop.

The patch removes the use of the Z_FINISH flag so that inflate() returns 
usable error codes. This also allows to continue the decoding where inflate 
stopped it when the buffer was not large enough for the decoded data.

I made two test cases [3], one I made when I reported the bug, and the other 
to test the case where the $length argument is too small, so that the 
function is almost entirely covered.

[1] http://arnaud.lb.s3.amazonaws.com/gzinflate-bug42663.patch
[2] http://bugs.php.net/bug.php?id=42663
[3] http://arnaud.lb.s3.amazonaws.com/gzinflate-phpt.tar.bz2

Regards,

Arnaud