Skip to content

Commit e8a0ae1

Browse files
committed
Fix memsize check for xxh32
Copy-paste mistake: The memsize limit for xxh32 should be 16, rather than 32 (which is correct for xxh64). Probably fixes oss-fuzz #29661.
1 parent 9862296 commit e8a0ae1

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

ext/hash/hash_xxhash.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ static int php_hash_xxh32_unserialize(
8484
int r = FAILURE;
8585
if (magic == PHP_HASH_SERIALIZE_MAGIC_SPEC
8686
&& (r = php_hash_unserialize_spec(hash, zv, PHP_XXH32_SPEC)) == SUCCESS
87-
&& ctx->s.memsize < 32) {
87+
&& ctx->s.memsize < 16) {
8888
return SUCCESS;
8989
} else {
9090
return r != SUCCESS ? r : -2000;

ext/hash/tests/xxhash_unserialize_memsize.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ xxhash memsize must be in range when unserializing
44
<?php
55
try {
66
$str = <<<'STR'
7-
O:11:"HashContext":5:{i:0;s:5:"xxh32";i:1;i:0;i:2;a:12:{i:0;i:0;i:1;i:0;i:2;i:606290984;i:3;i:-2048144777;i:4;i:0;i:5;i:1640531535;i:6;i:0;i:7;i:0;i:8;i:0;i:9;i:0;i:10;i:80;i:11;i:0;}i:3;i:2;i:4;a:0:{}}
7+
O:11:"HashContext":5:{i:0;s:5:"xxh32";i:1;i:0;i:2;a:12:{i:0;i:0;i:1;i:0;i:2;i:606290984;i:3;i:-2048144777;i:4;i:0;i:5;i:1640531535;i:6;i:0;i:7;i:0;i:8;i:0;i:9;i:0;i:10;i:30;i:11;i:0;}i:3;i:2;i:4;a:0:{}}
88
STR;
99
$hash = unserialize($str);
1010
hash_update($hash, '');

0 commit comments

Comments
 (0)