Skip to content

Commit 17bbd42

Browse files
committed
Fix GH-17921 socket_read/socket_recv overflows on buffer size.
update the existing checks to be more straightforward instead of counting on undefined behavior.
1 parent 9306248 commit 17bbd42

File tree

2 files changed

+22
-2
lines changed

2 files changed

+22
-2
lines changed

ext/sockets/sockets.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -884,7 +884,7 @@ PHP_FUNCTION(socket_read)
884884
ENSURE_SOCKET_VALID(php_sock);
885885

886886
/* overflow check */
887-
if ((length + 1) < 2) {
887+
if (length <= 0 || length == ZEND_LONG_MAX) {
888888
RETURN_FALSE;
889889
}
890890

@@ -1326,7 +1326,7 @@ PHP_FUNCTION(socket_recv)
13261326
ENSURE_SOCKET_VALID(php_sock);
13271327

13281328
/* overflow check */
1329-
if ((len + 1) < 2) {
1329+
if (len <= 0 || len == ZEND_LONG_MAX) {
13301330
RETURN_FALSE;
13311331
}
13321332

ext/sockets/tests/gh17921.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
GH-16267 - overflow on socket_strerror argument
3+
--EXTENSIONS--
4+
sockets
5+
--INI--
6+
memory_limit=-1
7+
--FILE--
8+
<?php
9+
$s_c_l = socket_create_listen(0);
10+
var_dump(socket_read($s_c_l, PHP_INT_MAX));
11+
var_dump(socket_read($s_c_l, PHP_INT_MIN));
12+
$a = "";
13+
var_dump(socket_recv($s_c_l, $a, PHP_INT_MAX, 0));
14+
var_dump(socket_recv($s_c_l, $a, PHP_INT_MIN, 0));
15+
?>
16+
--EXPECT--
17+
bool(false)
18+
bool(false)
19+
bool(false)
20+
bool(false)

0 commit comments

Comments
 (0)