Fix buffer overflow in hash_pbkdf2() with a large output length

NEWS

@@ -18,6 +18,10 @@ PHP                                                                        NEWS
   . Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the
     wrong argument in error messages. (Weilin Du)
 
+- Hash:
+  . Fixed a buffer overflow in hash_pbkdf2() with a large output length.
+    (Lazizbek Ergashev)
+
 - Intl:
   . Fixed a double-free when IntlGregorianCalendar construction fails after
     the ICU constructor adopts the TimeZone. (iliaal)

ext/hash/hash.c

@@ -19,7 +19,6 @@
 #include <config.h>
 #endif
 
-#include <math.h>
 #include "php_hash.h"
 #include "ext/standard/info.h"
 #include "ext/standard/file.h"
@@ -1043,10 +1042,10 @@ PHP_FUNCTION(hash_pbkdf2)
 	}
 	digest_length = length;
 	if (!raw_output) {
-		digest_length = (zend_long) ceil((float) length / 2.0);
+		digest_length = (length + 1) / 2;
 	}
 
-	loops = (zend_long) ceil((float) digest_length / (float) ops->digest_size);
+	loops = (digest_length + ops->digest_size - 1) / ops->digest_size;
 
 	result = safe_emalloc(loops, ops->digest_size, 0);
 

ext/hash/tests/hash_pbkdf2_large_length.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Hash: hash_pbkdf2() function : large output length
+--FILE--
+<?php
+
+$length = 33554433;
+$hash = hash_pbkdf2('md5', 'password', 'salt', 1, $length);
+
+/* The last hexit comes from the first byte of the final PBKDF2 block. */
+$block = intdiv(intdiv($length + 1, 2) - 1, 16) + 1;
+$expected = bin2hex(hash_hmac('md5', 'salt' . pack('N', $block), 'password', true));
+
+var_dump(strlen($hash));
+var_dump($hash[$length - 1] === $expected[0]);
+
+?>
+--EXPECT--
+int(33554433)
+bool(true)