php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-17921 socket_read/socket_recv overflows on buffer size.

Browse Source 
update the existing checks to be more straightforward instead of
counting on undefined behavior.

close GH-17923
This commit is contained in:
David Carlier
2025-02-25 05:08:12 +00:00
parent 00a772bf94
commit 8cbc0c57b7
3 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -65,6 +65,10 @@ PHP NEWS
. Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
(DanielEScherzer)
- Sockets:
. Fixed bug GH-17921 (socket_read/socket_recv overflow on buffer size).
(David Carlier)
- Standard:
. Fixed bug #72666 (stat cache clearing inconsistent between file:// paths
and plain paths). (Jakub Zelenka)

4
ext/sockets/sockets.c
View File

@@ -884,7 +884,7 @@ PHP_FUNCTION(socket_read)
ENSURE_SOCKET_VALID(php_sock);
/* overflow check */
if ((length + 1) < 2) {
if (length <= 0 || length == ZEND_LONG_MAX) {
RETURN_FALSE;
}
@@ -1326,7 +1326,7 @@ PHP_FUNCTION(socket_recv)
ENSURE_SOCKET_VALID(php_sock);
/* overflow check */
if ((len + 1) < 2) {
if (len <= 0 || len == ZEND_LONG_MAX) {
RETURN_FALSE;
}

18
ext/sockets/tests/gh17921.phpt Normal file
View File

@@ -0,0 +1,18 @@
--TEST--
GH-16267 - overflow on socket_strerror argument
--EXTENSIONS--
sockets
--FILE--
<?php
$s_c_l = socket_create_listen(0);
var_dump(socket_read($s_c_l, PHP_INT_MAX));
var_dump(socket_read($s_c_l, PHP_INT_MIN));
$a = "";
var_dump(socket_recv($s_c_l, $a, PHP_INT_MAX, 0));
var_dump(socket_recv($s_c_l, $a, PHP_INT_MIN, 0));
?>
--EXPECT--
bool(false)
bool(false)
bool(false)
bool(false)