Edit report at https://bugs.php.net/bug.php?id=68955&edit=1
ID: 68955
User updated by: bugreports at internot dot info
Reported by: bugreports at internot dot info
Summary: Int overflow in ext/bz2/bz2.c
Status: Not a bug
Type: Bug
Package: Bzip2 Related
Operating System: Linux Ubuntu 14.04
PHP Version: master-Git-2015-01-30 (Git)
Block user comment: N
Private report: N
New Comment:
I mean unsigned long long, sorry.
unsigned long long size = 0;
Previous Comments:
------------------------------------------------------------------------
[2015-02-01 07:06:03] stas@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to
report
a bug at http://bugs.php.net/how-to-report.php
total_out_hi32 already is unsigned int:
unsigned int total_out_hi32;
------------------------------------------------------------------------
[2015-01-30 03:14:57] bugreports at internot dot info
Description:
------------
Hi,
In /ext/bz2/bz2.c:
597 size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
and
603 size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
bzs.total_out_hi32 should be cast to unsigned int, to avoid an int overflow.
(is that -1 even right? that'll be a huge number since it's unsigned)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68955&edit=1