Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/hash: Fix buffer overflow in hash_pbkdf2() with a large output length

Author: devnexen

ext/hash/hash.c

@@ -17,7 +17,6 @@
 #include <config.h>
 #endif
 
-#include <math.h>
 #include "php_hash.h"
 #include "ext/standard/info.h"
 #include "ext/standard/file.h"
@@ -1033,10 +1032,10 @@ PHP_FUNCTION(hash_pbkdf2)
 	}
 	digest_length = length;
 	if (!raw_output) {
-		digest_length = (zend_long) ceil((float) length / 2.0);
+		digest_length = length / 2 + (length % 2);
 	}
 
-	loops = (zend_long) ceil((float) digest_length / (float) ops->digest_size);
+	loops = (digest_length - 1) / ops->digest_size + 1;
 
 	result = safe_emalloc(loops, ops->digest_size, 0);
 

ext/hash/tests/hash_pbkdf2_large_length.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Hash: hash_pbkdf2() function : large output length
+--FILE--
+<?php
+
+$length = 33554433;
+$hash = hash_pbkdf2('md5', 'password', 'salt', 1, $length);
+
+/* The last hexit comes from the first byte of the final PBKDF2 block. */
+$block = intdiv(intdiv($length + 1, 2) - 1, 16) + 1;
+$expected = bin2hex(hash_hmac('md5', 'salt' . pack('N', $block), 'password', true));
+
+var_dump(strlen($hash));
+var_dump($hash[$length - 1] === $expected[0]);
+
+?>
+--EXPECT--
+int(33554433)
+bool(true)

ext/hash/tests/hash_pbkdf2_max_length.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Hash: hash_pbkdf2() function : output length of PHP_INT_MAX
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE == 4) die("skip this test is not for 32bit platforms");
+if (getenv("USE_ZEND_ALLOC") === "0") die("skip Zend MM disabled");
+?>
+--INI--
+memory_limit=128M
+--FILE--
+<?php
+
+hash_pbkdf2('md5', 'password', 'salt', 1, PHP_INT_MAX);
+
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 134217728 bytes exhausted%s(tried to allocate 4611686018427387904 bytes) in %s on line %d

ext/hash/tests/hash_pbkdf2_max_length_raw.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Hash: hash_pbkdf2() function : raw output length of PHP_INT_MAX
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE == 4) die("skip this test is not for 32bit platforms");
+if (getenv("USE_ZEND_ALLOC") === "0") die("skip Zend MM disabled");
+?>
+--INI--
+memory_limit=128M
+--FILE--
+<?php
+
+hash_pbkdf2('md5', 'password', 'salt', 1, PHP_INT_MAX, true);
+
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 134217728 bytes exhausted%s(tried to allocate 9223372036854775808 bytes) in %s on line %d