Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
  Fix zlib support for large files
  Fix memory leak on overflow in _php_stream_scandir()

Author: ndossche

NEWS

@@ -55,6 +55,7 @@ PHP                                                                        NEWS
 
 - Streams:
   . Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
+  . Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
 
 - Windows:
   . Fixed phpize for Windows 11 (24H2). (bwoebi)
@@ -63,6 +64,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
     (nielsdos)
   . Fix memory leak when encoding check fails. (nielsdos)
+  . Fix zlib support for large files. (nielsdos)
 
 30 Jan 2025, PHP 8.4.4
 

ext/zlib/zlib_fopen_wrapper.c

@@ -33,24 +33,55 @@ struct php_gz_stream_data_t	{
 static ssize_t php_gziop_read(php_stream *stream, char *buf, size_t count)
 {
 	struct php_gz_stream_data_t *self = (struct php_gz_stream_data_t *) stream->abstract;
-	int read;
+	ssize_t total_read = 0;
+
+	/* Despite the count argument of gzread() being "unsigned int",
+	 * the return value is "int". Error returns are values < 0, otherwise the count is returned.
+	 * To properly distinguish error values from success value, we therefore need to cap at INT_MAX.
+	 */
+	do {
+		unsigned int chunk_size = MIN(count, INT_MAX);
+		int read = gzread(self->gz_file, buf, chunk_size);
+		count -= chunk_size;
+
+		if (gzeof(self->gz_file)) {
+			stream->eof = 1;
+		}
 
-	/* XXX this needs to be looped for the case count > UINT_MAX */
-	read = gzread(self->gz_file, buf, count);
+		if (UNEXPECTED(read < 0)) {
+			return read;
+		}
 
-	if (gzeof(self->gz_file)) {
-		stream->eof = 1;
-	}
+		total_read += read;
+		buf += read;
+	} while (count > 0 && !stream->eof);
 
-	return read;
+	return total_read;
 }
 
 static ssize_t php_gziop_write(php_stream *stream, const char *buf, size_t count)
 {
 	struct php_gz_stream_data_t *self = (struct php_gz_stream_data_t *) stream->abstract;
+	ssize_t total_written = 0;
+
+	/* Despite the count argument of gzread() being "unsigned int",
+	 * the return value is "int". Error returns are values < 0, otherwise the count is returned.
+	 * To properly distinguish error values from success value, we therefore need to cap at INT_MAX.
+	 */
+	do {
+		unsigned int chunk_size = MIN(count, INT_MAX);
+		int written = gzwrite(self->gz_file, buf, chunk_size);
+		count -= chunk_size;
+
+		if (UNEXPECTED(written < 0)) {
+			return written;
+		}
+
+		total_written += written;
+		buf += written;
+	} while (count > 0);
 
-	/* XXX this needs to be looped for the case count > UINT_MAX */
-	return gzwrite(self->gz_file, (char *) buf, count);
+    return total_written;
 }
 
 static int php_gziop_seek(php_stream *stream, zend_off_t offset, int whence, zend_off_t *newoffs)

main/streams/streams.c

@@ -2469,25 +2469,19 @@ PHPAPI int _php_stream_scandir(const char *dirname, zend_string **namelist[], in
 				vector_size = 10;
 			} else {
 				if(vector_size*2 < vector_size) {
-					/* overflow */
-					php_stream_closedir(stream);
-					efree(vector);
-					return -1;
+					goto overflow;
 				}
 				vector_size *= 2;
 			}
-			vector = (zend_string **) safe_erealloc(vector, vector_size, sizeof(char *), 0);
+			vector = (zend_string **) safe_erealloc(vector, vector_size, sizeof(zend_string *), 0);
 		}
 
 		vector[nfiles] = zend_string_init(sdp.d_name, strlen(sdp.d_name), 0);
 
-		nfiles++;
-		if(vector_size < 10 || nfiles == 0) {
-			/* overflow */
-			php_stream_closedir(stream);
-			efree(vector);
-			return -1;
+		if(vector_size < 10 || nfiles + 1 == 0) {
+			goto overflow;
 		}
+		nfiles++;
 	}
 	php_stream_closedir(stream);
 
@@ -2497,5 +2491,13 @@ PHPAPI int _php_stream_scandir(const char *dirname, zend_string **namelist[], in
 		qsort(*namelist, nfiles, sizeof(zend_string *), (int(*)(const void *, const void *))compare);
 	}
 	return nfiles;
+
+overflow:
+	php_stream_closedir(stream);
+	for (unsigned int i = 0; i < nfiles; i++) {
+		zend_string_efree(vector[i]);
+	}
+	efree(vector);
+	return -1;
 }
 /* }}} */