[php-src] PR #22920: Fix integer overflow in the JSON scanner string length adjustments
| From: | iliaal | Date: | Wed, 29 Jul 2026 12:49:40 +0000 |
| Subject: | [php-src] PR #22920: Fix integer overflow in the JSON scanner string length adjustments | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37332@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22920
Author: iliaal
php_json_scanner keeps escape shrinkage and invalid-UTF-8 adjustment in int fields. A string
carrying more than 2^31 escape sequences or ignored invalid bytes wraps the counter, and the first
pass then reserves a result several gigabytes longer than the second pass writes. json_decode() of a
2 GiB run of invalid bytes with JSON_INVALID_UTF8_IGNORE returns a 4 GiB string instead of an empty
one, and 2.4 GiB of A escapes returns 4.4 GiB instead of 409 MiB. There is no test because the
smallest trigger needs roughly 10 GiB of live memory. This targets master rather than 8.4 since
php_json_scanner.h is an installed header whose struct is embedded by value in php_json_parser, so
widening the fields changes the layout for anything that embeds it.