diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-06-28 11:11:25 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-06-28 11:11:25 +0800 |
| commit | c73a2f7f45fc4ad6bf45f5f6929606725f285cd7 (patch) | |
| tree | a288e9db628b55006a2cf4f1961cf73957076559 | |
| parent | ad32c7b538de017d8273ecd00bb3710d7a9c586a (diff) | |
| download | php-git-c73a2f7f45fc4ad6bf45f5f6929606725f285cd7.tar.gz | |
Fixed bug #72505 (readfile() mangles files larger than 2G)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | main/streams/streams.c | 2 |
2 files changed, 2 insertions, 1 deletions
@@ -21,6 +21,7 @@ PHP NEWS . Fixed bug #72463 (mail fails with invalid argument). (Anatol) - Standard: + . Fixed bug #72505 (readfile() mangles files larger than 2G). (Cschneid) . Fixed bug #72306 (Heap overflow through proc_open and $env parameter). (Laruence) diff --git a/main/streams/streams.c b/main/streams/streams.c index d64d5caa6a..e21d21a807 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -1396,7 +1396,7 @@ PHPAPI size_t _php_stream_passthru(php_stream * stream STREAMS_DC) if (p) { do { /* output functions return int, so pass in int max */ - if (0 < (b = PHPWRITE(p, MIN(mapped - bcount, INT_MAX)))) { + if (0 < (b = PHPWRITE(p + bcount, MIN(mapped - bcount, INT_MAX)))) { bcount += b; } } while (b > 0 && mapped > bcount); |