From: [EMAIL PROTECTED]
Operating system: kubuntu linux
PHP version: 5CVS-2007-01-22 (CVS)
PHP Bug Type: Zlib Related
Bug description: endless loop in zlib.inflate stream filter
Description:
------------
run the test pecl/phar/tests/phar_ctx_001.phpt or
pecl/phar/tests/phar_oo_compressed_001.phpt
and you will see an endless loop. The loop happens in
ext/zlib/zlib_filter.c at line 83:
while (bin < bucket->buflen) {
desired = bucket->buflen - bin;
if (desired > data->inbuf_len) {
desired = data->inbuf_len;
}
memcpy(data->strm.next_in, bucket->buf + bin, desired);
data->strm.avail_in = desired;
status = inflate(&(data->strm), flags &
PSFS_FLAG_FLUSH_CLOSE ?
Z_FINISH : Z_SYNC_FLUSH);
if (status != Z_OK && status != Z_STREAM_END) {
/* Something bad happened */
php_stream_bucket_delref(bucket TSRMLS_CC);
return PSFS_ERR_FATAL;
}
desired -= data->strm.avail_in; /* desired becomes what
we consumed
this round through */
data->strm.next_in = data->inbuf;
data->strm.avail_in = 0;
consumed += desired;
bin += desired;
if (data->strm.avail_out < data->outbuf_len) {
php_stream_bucket *out_bucket;
size_t bucketlen = data->outbuf_len -
data->strm.avail_out;
out_bucket = php_stream_bucket_new(stream,
estrndup(data->outbuf,
bucketlen), bucketlen, 1, 0 TSRMLS_CC);
php_stream_bucket_append(buckets_out,
out_bucket TSRMLS_CC);
data->strm.avail_out = data->outbuf_len;
data->strm.next_out = data->outbuf;
exit_status = PSFS_PASS_ON;
}
}
the loop should exit when desired is set to 0, but doesn't.
The attached patch fixes this issue.
Reproduce code:
---------------
Index: ext/zlib/zlib_filter.c
===================================================================
RCS file: /repository/php-src/ext/zlib/zlib_filter.c,v
retrieving revision 1.6.2.2.2.3
diff -u -r1.6.2.2.2.3 zlib_filter.c
--- ext/zlib/zlib_filter.c 1 Jan 2007 09:36:10 -0000
1.6.2.2.2.3
+++ ext/zlib/zlib_filter.c 22 Jan 2007 02:23:39 -0000
@@ -99,6 +99,10 @@
data->strm.avail_in = 0;
consumed += desired;
bin += desired;
+ if (!desired) {
+ flags |= PSFS_FLAG_FLUSH_CLOSE;
+ break;
+ }
if (data->strm.avail_out < data->outbuf_len) {
php_stream_bucket *out_bucket;
--
Edit bug report at http://bugs.php.net/?id=40189&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=40189&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=40189&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=40189&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=40189&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=40189&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=40189&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=40189&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=40189&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=40189&r=support
Expected behavior: http://bugs.php.net/fix.php?id=40189&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=40189&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=40189&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=40189&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=40189&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=40189&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=40189&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=40189&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=40189&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=40189&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=40189&r=mysqlcfg
