[Bug] xzdecode returns incomplete data (12288 bytes vs expected 12360)

[mgfzgw]

Bug Report

Description

xzdecode() returns incomplete decompressed data (12288 bytes) while the system xz command correctly extracts the same file to the expected size of 12360 bytes.

Environment

• OS: Windows 10 x64
• PHP version: 8.0.2
• Extension version: 1.2.1
• DLL file: php_xz-1.2.1-8.0-nts-vs16-x86_64
• Thread safety: NTS (Non-Thread Safe)
• Architecture: x64
• Compiler: VS16

Steps to Reproduce

1. Take a valid .xz file (compressed from a 12360-byte source)
2. Read the file content via file_get_contents()
3. Pass the compressed data to xzdecode()
4. Compare the output length with the expected size

Minimal Test Code

$xzFilePath = 'path/to/your/file.xz';
$compressedData = file_get_contents($xzFilePath);
$decompressedData = xzdecode($compressedData);

echo 'Expected size: 12360 bytes' . PHP_EOL;
echo 'Actual size: ' . strlen($decompressedData) . ' bytes' . PHP_EOL;

[demo.zip](https://github.com/user-attachments/files/27154706/demo.zip)

[mgfzgw]

Expected vs. Actual Behavior
Expected: Decompressed data length = 12360 bytes (full data)

Actual: Decompressed data length = 12288 bytes (missing 72 bytes)

Additional Verification
✅ The system command xz -d -c file.xz correctly extracts to 12360 bytes

✅ Other tools (7-Zip, etc.) extract correctly

✅ The compressed .xz file is intact (xz -t passes)

❌ Both extension versions (1.2.0 and 1.2.1) produce the incorrect 12288-byte result

[mgfzgw]

Important Update: Confirmed as a Cross-Platform Core Bug

I have now tested the extension on Linux (PHP 8.x), and the same exact problem occurs. The xzdecode() function returns 12288 bytes instead of the expected 12360.

This confirms the issue is not Windows-specific. It is a core bug in the decompression logic shared by both the codemasher and mateuszanella branches of this extension.

Tested environments (all fail):

Windows 10 + PHP 8.0.2 + xz 1.2.1 DLL ❌

Linux (OpenCloudOS 9.4 x86_64) + PHP 8.3.27 + xz 1.2.0 (compiled from source) ❌

The only reliable workaround across both platforms is to call the system xz -d -c command.

[codemasher]

Hey, thank you for the report!
May i ask if you have tested it with earlier versions of this library, e.g. 1.1.4 (before I ported the changes from mateuszanella) to see if the issue exists there too?

[codemasher]

Also, can you please attach the test data you used as plain text file, so that I can maybe include it in CI?

[mgfzgw]

I have tested version 1.1.4 and the issue still exists.

The test data is the same demo.zip file I attached earlier in this issue (you can find it above).

To summarize:

1.2.1 ❌ fails

1.2.0 ❌ fails

1.1.4 ❌ fails

It appears this bug has been present for a long time, even before you ported the changes from mateuszanella.

file:https://github.com/user-attachments/files/27154706/demo.zip

[codemasher]

Thank you for testing with earlier releases! I think the issue might be related to the underlying lzma libraries as the data is only handed over to them internally and is not touched by the xz extension itself (other than the read/write loops). As the extension uses the same lzma library that is included with the PHP source (as of PHP 8), there is a chance that other lzma related functions produce the same results, or, we're looking at an edge case.

The test data is the same demo.zip file I attached earlier in this issue (you can find it above).

The .zip file doesn't show up as the extension might be blocked, that's why I'm asking for plain text. edit: the second link worked

[mgfzgw]

Thanks for the detailed analysis!

I agree — if the extension just passes data through to the underlying liblzma (the one bundled with PHP 8+), then this is likely an edge case bug in PHP's internal lzma library, not your extension code.

For now, I'll stick with the system xz -d -c workaround since it's reliable.

Let me know if you need me to test any patch or provide more sample files.

[codemasher]

Thank you! Right now I can only do very little as i don't have the means to properly test locally, nor the proper insight into the underlying libraries (or C itself for that matter), so I'll leave this issue open and tag it as help wanted.

[codemasher]

I've added the test to CI on a different branch and this is getting even more curious...