MFH: Fixed bug #61287 (A particular string fails to decompress)

php · Mar 5, 2012 · 39d2996 · 39d2996
1 parent f05886d
commit 39d2996
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -61,6 +61,7 @@ PHP                                                                        NEWS
 
 - Zlib:
   . Fixed bug #61139 (gzopen leaks when specifying invalid mode). (Nikita Popov)
+  . Fixed bug #61287 (A particular string fails to decompress). (Mike)
 
 01 Mar 2012, PHP 5.4.0 
 

diff --git a/ext/zlib/php_zlib.h b/ext/zlib/php_zlib.h
@@ -65,6 +65,7 @@ extern zend_module_entry php_zlib_module_entry;
 #define phpext_zlib_ptr zlib_module_ptr
 
 #ifdef ZTS
+# include "TSRM.h"
 # define ZLIBG(v) TSRMG(zlib_globals_id, zend_zlib_globals *, v)
 #else
 # define ZLIBG(v) (zlib_globals.v)

diff --git a/ext/zlib/tests/bug61287.phpt b/ext/zlib/tests/bug61287.phpt
@@ -0,0 +1,24 @@
+--TEST--
+bug #61287 - inflate needs the terminating null byte
+--SKIPIF--
+<?php extension_loaded("zlib") or die("SKIP need zlib");
+--FILE--
+<?php
+$array = array(
+    'region_id' => 1,
+    'discipline' => 23,
+    'degrees' => array(),
+    'country_id' => 27
+);
+
+$serialized = serialize($array);
+
+$deflated = gzdeflate($serialized, 9);
+$inflated = gzinflate($deflated);
+
+echo strlen($inflated),"\n";
+?>
+Done
+--EXPECT--
+92
+Done
diff --git a/ext/zlib/zlib.c b/ext/zlib/zlib.c
@@ -400,7 +400,7 @@ static int php_zlib_decode(const char *in_buf, size_t in_len, char **out_buf, si
 		status = inflateInit2(&Z, encoding);
 		if (Z_OK == status) {
 			Z.next_in = (Bytef *) in_buf;
-			Z.avail_in = in_len;
+			Z.avail_in = in_len + 1; /* NOTE: data must be zero terminated */
 
 			switch (status = php_zlib_inflate_rounds(&Z, max_len, out_buf, out_len)) {
 				case Z_STREAM_END: