php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix GH-15980: Signed integer overflow in main/streams/streams.c
This commit is contained in:
Christoph M. Becker
2024-09-24 12:33:00 +02:00
parent 22d25d2896 81916758ec
commit acee803e6a
3 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -23,6 +23,8 @@ PHP NEWS
- Streams:
. Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
(nielsdos)
. Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
(cmb)
- TSRM:
. Prevent closing of unrelated handles. (cmb)

12
ext/standard/tests/streams/gh15980.phpt Normal file
View File

@@ -0,0 +1,12 @@
--TEST--
GH-15980 (Signed integer overflow in main/streams/streams.c)
--FILE--
<?php
$s = fopen(__FILE__, "r");
fseek($s, 1);
$seekres = fseek($s, PHP_INT_MAX, SEEK_CUR);
$tellres = ftell($s);
var_dump($seekres === -1 || $tellres > 1);
?>
--EXPECT--
bool(true)

9
main/streams/streams.c
View File

@@ -1382,8 +1382,13 @@ PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence)
switch(whence) {
case SEEK_CUR:
offset = stream->position + offset;
whence = SEEK_SET;
ZEND_ASSERT(stream->position >= 0);
if (UNEXPECTED(offset > ZEND_LONG_MAX - stream->position)) {
offset = ZEND_LONG_MAX;
} else {
offset = stream->position + offset;
}
whence = SEEK_SET;
break;
}
ret = stream->ops->seek(stream, offset, whence, &stream->position);