# Heap overflow due to integer overflow in bzdecompress() function

Integer overflow in PHP bzdecompress() on 32-bit causes undersized zend_string allocation, leading to heap overflow and EIP control.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: fosec
- Disclosed: 2019-11-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/180563
- Library page: https://bugbountylibrary.com/r/h1%3A180563
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:memory-corruption

**Target:** PHP ext/bz2 bzdecompress() function
**Root cause:** bzs.avail_out = source_len * 2 overflows on 32-bit when source_len is large, so zend_string_alloc allocates a small buffer that decompression then overflows.
**Steps:**
1. Build PHP 7.1 on a 32-bit machine with bz2 extension.
2. Run the PoC: compress a string, pad it to 4634 bytes, repeat to ~0x7ffffffe total length.
3. Call `bzdecompress($a)` to trigger the integer overflow and heap overflow.
4. Observe EIP overwritten with 0x42424242 from the 'BBBB' input.
**How found:** Code review of ext/bz2/bz2.c:589 spotted the unchecked source_len * 2 multiplication feeding zend_string_alloc, then crafted a large compressed input to overflow the size on 32-bit.
**Exploitation:** Attacker supplies a large crafted compressed string to bzdecompress(); source_len*2 overflows, small allocation occurs, decompression writes past the buffer, overwriting saved return address and controlling EIP for code execution.
**Insight:** Audit size computations that multiply attacker-controlled lengths before allocation; on 32-bit targets, look for `len * N` patterns that wrap and produce undersized buffers for decompression/decoding routines.