com php-src: Improve fix for bug #72837: ext/bz2/bz2.c

Commit: 2d123a916d46117a7952e6ac1090ff615ca5df0e Author: Anatol Belski <ab@php.net> Fri, 19 Aug 2016 12:48:13 +0200 Parents: 4df85466b6c0d35d02fcba50ec6b263787730d8c Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2d123a916d46117a7952e6ac1090ff615ca5df0e Log: Improve fix for bug #72837 Bugs: https://bugs.php.net/72837 Changed paths: M ext/bz2/bz2.c Diff: diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c index 60bb71e..573b6e2 100644 --- a/ext/bz2/bz2.c +++ b/ext/bz2/bz2.c @@ -561,7 +561,8 @@ static PHP_FUNCTION(bzcompress) Decompresses BZip2 compressed data */ static PHP_FUNCTION(bzdecompress) { - char *source, *dest; + char *source; + zend_string *dest; size_t source_len; int error; zend_long small = 0; @@ -588,34 +589,40 @@ static PHP_FUNCTION(bzdecompress) /* in most cases bz2 offers at least 2:1 compression, so we use that as our base */ bzs.avail_out = source_len * 2; - bzs.next_out = dest = emalloc(bzs.avail_out + 1); + dest = zend_string_alloc(bzs.avail_out + 1, 0); + bzs.next_out = ZSTR_VAL(dest); while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) { /* compression is better then 2:1, need to allocate more memory */ bzs.avail_out = source_len; size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32; +#if !ZEND_ENABLE_ZVAL_LONG64 if (size > SIZE_MAX) { /* no reason to continue if we're going to drop it anyway */ break; } - dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size ); - bzs.next_out = dest + size; +#endif + dest = zend_string_safe_realloc(dest, 1, bzs.avail_out+1, (size_t) size, 0); + bzs.next_out = ZSTR_VAL(dest) + size; } if (error == BZ_STREAM_END || error == BZ_OK) { size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32; - if (size > SIZE_MAX) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %zd", SIZE_MAX); - efree(dest); +#if !ZEND_ENABLE_ZVAL_LONG64 + if (UNEXPECTED(size > SIZE_MAX)) { + php_error_docref(NULL, E_WARNING, "Decompressed size too big, max is %zd", SIZE_MAX); + zend_string_free(dest); RETVAL_LONG(BZ_MEM_ERROR); - } else { - dest = safe_erealloc(dest, 1, (size_t) size, 1); - dest[size] = '\0'; - RETVAL_STRINGL(dest, (size_t) size); - efree(dest); + } else +#endif + { + dest = zend_string_safe_realloc(dest, 1, (size_t)size, 1, 0); + ZSTR_LEN(dest) = (size_t)size; + ZSTR_VAL(dest)[(size_t)size] = '\0'; + RETVAL_STR(dest); } } else { /* real error */ - efree(dest); + zend_string_free(dest); RETVAL_LONG(error); }