php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-18421: Integer overflow with large numbers in LimitIterator
This commit is contained in:
Niels Dossche
2025-04-25 20:06:24 +02:00
parent 0029d2b08b 4ff41cfb4b
commit e3433fdaef
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ext/spl/spl_iterators.c
View File

@@ -2134,7 +2134,7 @@ static inline void spl_limit_it_seek(spl_dual_it_object *intern, zend_long pos)
zend_throw_exception_ex(spl_ce_OutOfBoundsException, 0, "Cannot seek to " ZEND_LONG_FMT " which is below the offset " ZEND_LONG_FMT, pos, intern->u.limit.offset);
return;
}
if (pos >= intern->u.limit.offset + intern->u.limit.count && intern->u.limit.count != -1) {
if (pos - intern->u.limit.offset >= intern->u.limit.count && intern->u.limit.count != -1) {
zend_throw_exception_ex(spl_ce_OutOfBoundsException, 0, "Cannot seek to " ZEND_LONG_FMT " which is behind offset " ZEND_LONG_FMT " plus count " ZEND_LONG_FMT, pos, intern->u.limit.offset, intern->u.limit.count);
return;
}

17
ext/spl/tests/gh18421.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
GH-18421 (Integer overflow with large numbers in LimitIterator)
--FILE--
<?php
$a = array('zero' => 0, 'one' => 1, 'two' => 2, 'three' => 3, 'four' => 4, 'five' => 5);
try {
foreach (new LimitIterator(new ArrayIterator($a), PHP_INT_MAX, PHP_INT_MAX) as $k => $v)
{
}
} catch (OutOfBoundsException $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECTF--
Seek position %d is out of range