php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

curl: Don't truncate length

Browse Source 
Truncating to an int seems dangerous, esp. in combination with a MIN
macro. I don't see a reason to truncate the length from size_t to int,
and especially no reason to change the signedness.

Closes GH-20747.
This commit is contained in:
Niels Dossche
2025-12-21 01:48:46 +01:00
committed by ndossche
parent b911748fef
commit e2059a4697
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -15,6 +15,7 @@ PHP NEWS
- Curl:
. Fixed bug GH-21023 (CURLOPT_XFERINFOFUNCTION crash with a null callback).
(David Carlier)
. Don't truncate length. (ndossche)
- Date:
. Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).

6
ext/curl/interface.c
View File

@@ -583,7 +583,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
return fwrite(data, size, nmemb, write_handler->fp);
case PHP_CURL_RETURN:
if (length > 0) {
smart_str_appendl(&write_handler->buf, data, (int) length);
smart_str_appendl(&write_handler->buf, data, length);
}
break;
case PHP_CURL_USER: {
@@ -860,7 +860,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
if (!Z_ISUNDEF(retval)) {
_php_curl_verify_handlers(ch, /* reporterror */ true);
if (Z_TYPE(retval) == IS_STRING) {
length = MIN((size * nmemb), Z_STRLEN(retval));
length = MIN(size * nmemb, Z_STRLEN(retval));
memcpy(data, Z_STRVAL(retval), length);
} else if (Z_TYPE(retval) == IS_LONG) {
length = Z_LVAL_P(&retval);
@@ -891,7 +891,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
/* Handle special case write when we're returning the entire transfer
*/
if (ch->handlers.write->method == PHP_CURL_RETURN && length > 0) {
smart_str_appendl(&ch->handlers.write->buf, data, (int) length);
smart_str_appendl(&ch->handlers.write->buf, data, length);
} else {
PHPWRITE(data, length);
}