The bit counter update in PHP_GOSTUpdate() and PHP_SNEFRUUpdate() set the
low word one too high when it wrapped, and added at most one carry to the
high word per update. Snefru also computed the bit length of a single
update in 32 bits. The encoded message length, and thus the digest, was
wrong for inputs of 2^29 bytes or more. Compute the counter with 64-bit
arithmetic.
Closes GH-24555.
php_hash_do_hash() hardcodes argument index 1 in the isfilename branch,
so hash_file() blames $algo for a null byte carried by $filename.
hash_file() is the only caller passing isfilename = 1, and its filename
is argument #2; php_hash_do_hash_hmac() already uses 2 for the same
check.
Co-authored-by: NickSdot <32384907+NickSdot@users.noreply.github.com>
hash_pbkdf2() sized the digest buffer with ceil((float) length / 2.0) and
the block count with ceil((float) digest_length / (float) ops->digest_size).
A float carries 24 bits of mantissa, so past 2^24 the conversion rounds and
both counts come out wrong: rounding up makes zend_bin2hex() write past the
end of the return string, rounding down leaves the tail of the string
uninitialized. hash_pbkdf2('md5', 'password', 'salt', 1, 268435473) writes
8 bytes out of bounds under ASAN.
Both counts are exact in integer arithmetic, so this replaces them with
round-up divisions, which also avoids the signed overflow with an output
length of PHP_INT_MAX. <math.h> had no other user in the file.
Close GH-23380
* ext/bz2: applied fixers to improve test robustness
* ext/calendar: applied fixers to improve test robustness
* ext/exif: applied fixers to improve test robustness
* ext/fileinfo: applied fixers to improve test robustness
* ext/filter: applied fixers to improve test robustness
* ext/ftp: applied fixers to improve test robustness
* ext/hash: applied fixers to improve test robustness
* ext/iconv: applied fixers to improve test robustness
* ext/ldap: applied fixers to improve test robustness
* ext/pcre: applied fixers to improve test robustness
* ext/posix: applied fixers to improve test robustness
* ext/readline: applied fixers to improve test robustness
* ext/shmop: applied fixers to improve test robustness
* ext/snmp: applied fixers to improve test robustness
* ext/sodium: applied fixers to improve test robustness
* ext/sqlite3: applied fixers to improve test robustness
* ext/sysvmsg: applied fixers to improve test robustness
* ext/sysvsem: applied fixers to improve test robustness
* ext/sysvshm: applied fixers to improve test robustness
* ext/tidy: applied fixers to improve test robustness
* ext/tokenizer: applied fixers to improve test robustness
* ext/zend_test: applied fixers to improve test robustness
* ext/zlib: applied fixers to improve test robustness
* PHP-8.1:
Fix GH-12223: Entity reference produces infinite loop in var_dump/print_r
Fix GH-12192: SimpleXML infinite loop when getName() is called within foreach
Fix GH-12186: segfault copying/cloning a finalized HashContext
The initialization routine for XXH3 was not prepared for exceptions from seed.
Fix this by using try_convert_to_string.
For discussion, please see: GH-10305
Closes GH-10352
Signed-off-by: George Peter Banyard <girgias@php.net>
We must not allow to serialize already finalized `HashContext`s, since
the internal context is already freed. Since there is not much point
in serializing finalized `HashContext`s, we just bail out in that case.
Closes GH-8265.
ndossche