diff --git a/NEWS b/NEWS index f8e6f5ee82f..f127cce068f 100644 --- a/NEWS +++ b/NEWS @@ -29,6 +29,8 @@ PHP NEWS - Streams: . Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c). (nielsdos) + . Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c). + (cmb) - TSRM: . Prevent closing of unrelated handles. (cmb) diff --git a/ext/standard/tests/streams/gh15980.phpt b/ext/standard/tests/streams/gh15980.phpt new file mode 100644 index 00000000000..125751648bf --- /dev/null +++ b/ext/standard/tests/streams/gh15980.phpt @@ -0,0 +1,11 @@ +--TEST-- +GH-15980 (Signed integer overflow in main/streams/streams.c) +--FILE-- + 1); +?> +--EXPECT-- +bool(true) diff --git a/main/streams/streams.c b/main/streams/streams.c index e22d9e51d59..4c66d8aadc3 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -1354,8 +1354,13 @@ PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence) switch(whence) { case SEEK_CUR: - offset = stream->position + offset; - whence = SEEK_SET; + ZEND_ASSERT(stream->position >= 0); + if (UNEXPECTED(offset > ZEND_LONG_MAX - stream->position)) { + offset = ZEND_LONG_MAX; + } else { + offset = stream->position + offset; + } + whence = SEEK_SET; break; } ret = stream->ops->seek(stream, offset, whence, &stream->position);