mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 01:44:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3'

Browse Source 
* PHP-8.3:
  Fix GH-15980: Signed integer overflow in main/streams/streams.c
This commit is contained in:
Christoph M. Becker 2024-09-24 12:34:35 +02:00
commit f44250c418
No known key found for this signature in database
GPG Key ID: D66C9593118BCCB6
3 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -65,6 +65,8 @@ PHP NEWS
- Streams:
. Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
(nielsdos)
. Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
(cmb)
- TSRM:
. Prevent closing of unrelated handles. (cmb)

12
ext/standard/tests/streams/gh15980.phpt Normal file
View File

@ -0,0 +1,12 @@
--TEST--
GH-15980 (Signed integer overflow in main/streams/streams.c)
--FILE--
<?php
$s = fopen(__FILE__, "r");
fseek($s, 1);
$seekres = fseek($s, PHP_INT_MAX, SEEK_CUR);
$tellres = ftell($s);
var_dump($seekres === -1 || $tellres > 1);
?>
--EXPECT--
bool(true)

9
main/streams/streams.c
View File

@ -1382,8 +1382,13 @@ PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence)
switch(whence) {
case SEEK_CUR:
offset = stream->position + offset;
whence = SEEK_SET;
ZEND_ASSERT(stream->position >= 0);
if (UNEXPECTED(offset > ZEND_LONG_MAX - stream->position)) {
offset = ZEND_LONG_MAX;
} else {
offset = stream->position + offset;
}
whence = SEEK_SET;
break;
}
ret = stream->ops->seek(stream, offset, whence, &stream->position);