[GIT-PULLS] [php-src] PR #22786: ext/standard: reject a dechunk chunk size that overflows size_t
[email protected] (iliaal) Fri, 17 Jul 2026 14:04:26 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <oqiPWzQkUc4JJlVR8P0472YlVndMCJpxoCBP5MsKB7A@main.internal.php.net> |
Pull Request: https://github.com/php/php-src/pull/22786
Author: iliaal
`php_dechunk()` accumulated the hex chunk size with `chunk_size * 16 + digit` and never checked the multiply. A size of `10000000000000000` is 2^64, which wraps to 0, and 0 reads as the terminating chunk, so the filter stops and drops the body it was handed:
// before
string(0) "" // 10000000000000000\nBODYDATA\n0\n
// after
string(13) "0\nBODYDATA\n0\n" // CHUNK_ERROR, passed through like other malformed sizes
The guard is hoisted out of the three digit branches rather than repeated in each, which needs the digit value computed first. `SIZE_MAX / 16` is sufficient for the add as well: the largest value that survives it is `SIZE_MAX / 16`, and `SIZE_MAX / 16 * 16 + 15` is exactly `SIZE_MAX`.