#42663 [Opn->Csd]: gzinflate() try to allocate all memory with truncated $data

ID: 42663 Updated by: lbarnaud@php.net Reported By: arnaud dot lb at gmail dot com -Status: Open +Status: Closed Bug Type: Zlib Related Operating System: Linux 2.6 PHP Version: 5.2.4 New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2008-07-11 09:36:33] arnaud dot lb at gmail dot com I made a patch for this bug: http://marc.info/?l=php-internals&m=121561206424622&w=1 ------------------------------------------------------------------------ [2007-09-29 02:15:24] arnaud dot lb at gmail dot com I wrote a testcase for this bug: http://s3.amazonaws.com/arnaud.lb/gzinflate-bug42663.phpt.txt ------------------------------------------------------------------------ [2007-09-16 17:43:11] arnaud dot lb at gmail dot com It works with any compressed data if you truncate it. The yuicompressor-1.0.zip file used for this example can be found here: http://www.julienlecomte.net/yuicompressor/yuicompressor-1.0.zip ------------------------------------------------------------------------ [2007-09-16 14:52:47] iliaa@php.net Can you please provide a URL to the file with corrupted data. ------------------------------------------------------------------------ [2007-09-13 18:33:23] arnaud dot lb at gmail dot com Example code in a more readable format: <?php ini_set('memory_limit', -1); // compressing a ~1.6MB file with gzdeflate() $data = gzdeflate(file_get_contents("/home/noch/yuicompressor-1.0.zip"), 9); echo "Compressed length: " . strlen($data) . "\n"; // gzinflate() works with original $data gzinflate($data); // Truncating compressed $data $data = substr($data, 0, 65535); echo "Truncated length: " . strlen($data) . "\n"; // Bug is here: gzinflate($data); ?> ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/42663 -- Edit this bug report at http://bugs.php.net/?id=42663&edit=1