[GIT-PULLS] [php-src] PR #22786: ext/standard: reject a dechunk chunk size that overflows size_t

[email protected] (iliaal) Fri, 17 Jul 2026 14:04:26 +0000
Newsgroups php.git-pulls
Message-ID <oqiPWzQkUc4JJlVR8P0472YlVndMCJpxoCBP5MsKB7A@main.internal.php.net>
Pull Request: https://github.com/php/php-src/pull/22786
Author: iliaal

`php_dechunk()` accumulated the hex chunk size with `chunk_size * 16 + digit` and never checked the multiply. A size of `10000000000000000` is 2^64, which wraps to 0, and 0 reads as the terminating chunk, so the filter stops and drops the body it was handed:

    // before
    string(0) ""                     // 10000000000000000\nBODYDATA\n0\n
    // after
    string(13) "0\nBODYDATA\n0\n"    // CHUNK_ERROR, passed through like other malformed sizes

The guard is hoisted out of the three digit branches rather than repeated in each, which needs the digit value computed first. `SIZE_MAX / 16` is sufficient for the add as well: the largest value that survives it is `SIZE_MAX / 16`, and `SIZE_MAX / 16 * 16 + 15` is exactly `SIZE_MAX`.