From 95e52bd8c306ad4040158c6200ae9335bea5a95d Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Wed, 19 Aug 2026 17:47:11 +0500
Subject: [PATCH] Fix buffer overflow in hash_pbkdf2() with a large output
 length

---
 NEWS                                         |  4 ++++
 ext/hash/hash.c                              |  5 ++---
 ext/hash/tests/hash_pbkdf2_large_length.phpt | 19 +++++++++++++++++++
 3 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 ext/hash/tests/hash_pbkdf2_large_length.phpt

diff --git a/NEWS b/NEWS
index e273a86dfca6..9e9d6ac1644d 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ PHP                                                                        NEWS
   . Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the
     wrong argument in error messages. (Weilin Du)
 
+- Hash:
+  . Fixed a buffer overflow in hash_pbkdf2() with a large output length.
+    (Lazizbek Ergashev)
+
 - Intl:
   . Fixed a double-free when IntlGregorianCalendar construction fails after
     the ICU constructor adopts the TimeZone. (iliaal)
diff --git a/ext/hash/hash.c b/ext/hash/hash.c
index 1c90f4821f1a..2ac03a56096b 100644
--- a/ext/hash/hash.c
+++ b/ext/hash/hash.c
@@ -19,7 +19,6 @@
 #include <config.h>
 #endif
 
-#include <math.h>
 #include "php_hash.h"
 #include "ext/standard/info.h"
 #include "ext/standard/file.h"
@@ -1043,10 +1042,10 @@ PHP_FUNCTION(hash_pbkdf2)
 	}
 	digest_length = length;
 	if (!raw_output) {
-		digest_length = (zend_long) ceil((float) length / 2.0);
+		digest_length = (length + 1) / 2;
 	}
 
-	loops = (zend_long) ceil((float) digest_length / (float) ops->digest_size);
+	loops = (digest_length + ops->digest_size - 1) / ops->digest_size;
 
 	result = safe_emalloc(loops, ops->digest_size, 0);
 
diff --git a/ext/hash/tests/hash_pbkdf2_large_length.phpt b/ext/hash/tests/hash_pbkdf2_large_length.phpt
new file mode 100644
index 000000000000..527e238a2cc3
--- /dev/null
+++ b/ext/hash/tests/hash_pbkdf2_large_length.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Hash: hash_pbkdf2() function : large output length
+--FILE--
+<?php
+
+$length = 33554433;
+$hash = hash_pbkdf2('md5', 'password', 'salt', 1, $length);
+
+/* The last hexit comes from the first byte of the final PBKDF2 block. */
+$block = intdiv(intdiv($length + 1, 2) - 1, 16) + 1;
+$expected = bin2hex(hash_hmac('md5', 'salt' . pack('N', $block), 'password', true));
+
+var_dump(strlen($hash));
+var_dump($hash[$length - 1] === $expected[0]);
+
+?>
+--EXPECT--
+int(33554433)
+bool(true)