diff --git a/NEWS b/NEWS index 86d23228c20..0294db412d2 100644 --- a/NEWS +++ b/NEWS @@ -65,6 +65,10 @@ PHP NEWS . Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c). (DanielEScherzer) +- Sockets: + . Fixed bug GH-17921 (socket_read/socket_recv overflow on buffer size). + (David Carlier) + - Standard: . Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths). (Jakub Zelenka) diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c index e6e231e2e5e..c252dc6e07a 100644 --- a/ext/sockets/sockets.c +++ b/ext/sockets/sockets.c @@ -884,7 +884,7 @@ PHP_FUNCTION(socket_read) ENSURE_SOCKET_VALID(php_sock); /* overflow check */ - if ((length + 1) < 2) { + if (length <= 0 || length == ZEND_LONG_MAX) { RETURN_FALSE; } @@ -1326,7 +1326,7 @@ PHP_FUNCTION(socket_recv) ENSURE_SOCKET_VALID(php_sock); /* overflow check */ - if ((len + 1) < 2) { + if (len <= 0 || len == ZEND_LONG_MAX) { RETURN_FALSE; } diff --git a/ext/sockets/tests/gh17921.phpt b/ext/sockets/tests/gh17921.phpt new file mode 100644 index 00000000000..d038ed04bc9 --- /dev/null +++ b/ext/sockets/tests/gh17921.phpt @@ -0,0 +1,18 @@ +--TEST-- +GH-16267 - overflow on socket_strerror argument +--EXTENSIONS-- +sockets +--FILE-- + +--EXPECT-- +bool(false) +bool(false) +bool(false) +bool(false)