Move cwd_state and path related routines to size_t

Having `int` there is no real profit in the size or speed, while unsigned
improves security and overall integration. ZPP supplied strings can
be then accepted directly and structs can be still handled with smaller
unsigned types for size reasons, which is safe. Yet some related places
are to go.

basic move tsrm_realpath_r to size_t

fix conditions and sync with affected places

touch ocurrences of php_sys_readlink usage

follow up on phar path handling

remove duplicated check

move zend_resolve_path and related pieces to size_t

touch yet resolve path related places

remove cast

missing pieces

missing piece

yet cleanups for php_sys_readlink for ssize_t

fix wrong return

1 files changed, 57 insertions, 56 deletions

diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c
index e9ffda7cc3..e0d890a87a 100644
--- a/Zend/zend_virtual_cwd.c
+++ b/Zend/zend_virtual_cwd.c
@@ -163,7 +163,7 @@ static inline time_t FileTimeToUnixTime(const FILETIME *FileTime)
 	return (time_t)UnixTime;
 }
 
-CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){ /* {{{ */
+CWD_API ssize_t php_sys_readlink(const char *link, char *target, size_t target_len){ /* {{{ */
 	HANDLE hFile;
 	wchar_t *linkw = php_win32_ioutil_any_to_w(link), targetw[MAXPATHLEN];
 	size_t ret_len, targetw_len, offset = 0;
@@ -229,7 +229,7 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
 	CloseHandle(hFile);
 	free(linkw);
 
-	return ret_len;
+	return (ssize_t)ret_len;
 }
 /* }}} */
 
@@ -404,7 +404,7 @@ CWD_API void virtual_cwd_startup(void) /* {{{ */
 		cwd[0] = '\0';
 	}
 
-	main_cwd_state.cwd_length = (int)strlen(cwd);
+	main_cwd_state.cwd_length = strlen(cwd);
 #ifdef ZEND_WIN32
 	if (main_cwd_state.cwd_length >= 2 && cwd[1] == ':') {
 		cwd[0] = toupper(cwd[0]);
@@ -706,10 +706,10 @@ CWD_API realpath_cache_bucket** realpath_cache_get_buckets(void)
 #undef LINK_MAX
 #define LINK_MAX 32
 
-static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, int use_realpath, int is_dir, int *link_is_dir) /* {{{ */
+static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, time_t *t, int use_realpath, int is_dir, int *link_is_dir) /* {{{ */
 {
-	int i, j, save;
-	int directory = 0;
+	size_t i, j;
+	int directory = 0, save;
 #ifdef ZEND_WIN32
 	WIN32_FIND_DATAW dataw;
 	HANDLE hFind = INVALID_HANDLE_VALUE;
@@ -739,7 +739,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		}
 
 		if (i == len ||
-			(i == len - 1 && path[i] == '.')) {
+			(i + 1 == len && path[i] == '.')) {
 			/* remove double slashes and '.' */
 			len = i - 1;
 			is_dir = 1;
@@ -750,7 +750,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			if (link_is_dir) {
 				*link_is_dir = 1;
 			}
-			if (i - 1 <= start) {
+			if (i <= start + 1) {
 				return start ? start : len;
 			}
 			j = tsrm_realpath_r(path, start, i-1, ll, t, use_realpath, 1, NULL);
@@ -798,7 +798,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			if ((bucket = realpath_cache_find(path, len, *t)) != NULL) {
 				if (is_dir && !bucket->is_dir) {
 					/* not a directory */
-					return -1;
+					return (size_t)-1;
 				} else {
 					if (link_is_dir) {
 						*link_is_dir = bucket->is_dir;
@@ -813,14 +813,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
-				return -1;
+				return (size_t)-1;
 			}
 			hFind = FindFirstFileExW(pathw, FindExInfoBasic, &dataw, FindExSearchNameMatch, NULL, 0);
 			if (INVALID_HANDLE_VALUE == hFind) {
 				if (use_realpath == CWD_REALPATH) {
 					/* file not found */
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				/* continue resolution anyway but don't save result in the cache */
 				save = 0;
@@ -840,7 +840,8 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			HANDLE hLink = NULL;
 			REPARSE_DATA_BUFFER * pbuffer;
 			DWORD retlength = 0;
-			int bufindex = 0, isabsolute = 0;
+			size_t bufindex = 0;
+			uint8_t isabsolute = 0;
 			wchar_t * reparsetarget;
 			BOOL isVolume = FALSE;
 #if VIRTUAL_CWD_DEBUG
@@ -848,20 +849,20 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 #endif
 			char *substitutename = NULL;
 			size_t substitutename_len;
-			int substitutename_off = 0;
+			size_t substitutename_off = 0;
 			wchar_t tmpsubstname[MAXPATHLEN];
 
 			if(++(*ll) > LINK_MAX) {
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			hLink = CreateFileW(pathw, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
 			if(hLink == INVALID_HANDLE_VALUE) {
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			pbuffer = (REPARSE_DATA_BUFFER *)do_alloca(MAXIMUM_REPARSE_DATA_BUFFER_SIZE, use_heap_large);
@@ -869,14 +870,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				CloseHandle(hLink);
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
 				free_alloca(pbuffer, use_heap_large);
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			CloseHandle(hLink);
@@ -890,7 +891,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 #endif
 
@@ -899,7 +900,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength);
 				tmpsubstname[substitutename_len] = L'\0';
@@ -912,7 +913,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free(printname);
 #endif
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			else if(pbuffer->ReparseTag == IO_REPARSE_TAG_MOUNT_POINT) {
@@ -924,7 +925,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 #endif
 
@@ -934,7 +935,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength);
 				tmpsubstname[substitutename_len] = L'\0';
@@ -947,7 +948,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free(printname);
 #endif
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP) {
@@ -957,7 +958,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				memcpy(substitutename, path, len + 1);
 				substitutename_len = len;
@@ -966,7 +967,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				free_alloca(pbuffer, use_heap_large);
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			if(isabsolute && substitutename_len > 4) {
@@ -993,7 +994,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 
 			if (!isVolume) {
 				char * tmp2 = substitutename + substitutename_off;
-				for(bufindex = 0; bufindex < (substitutename_len - substitutename_off); bufindex++) {
+				for (bufindex = 0; bufindex + substitutename_off < substitutename_len; bufindex++) {
 					*(path + bufindex) = *(tmp2 + bufindex);
 				}
 
@@ -1017,10 +1018,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
 					j = tsrm_realpath_r(path, 0, j, ll, t, 0, is_dir, &directory);
-					if(j < 0) {
+					if(j == (size_t)-1) {
 						free_alloca(tmp, use_heap);
 						FREE_PATHW()
-						return -1;
+						return (size_t)-1;
 					}
 				}
 			}
@@ -1028,17 +1029,17 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if(i + j >= MAXPATHLEN - 1) {
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 
 				memmove(path+i, path, j+1);
 				memcpy(path, tmp, i-1);
 				path[i-1] = DEFAULT_SLASH;
 				j  = tsrm_realpath_r(path, start, i + j, ll, t, use_realpath, is_dir, &directory);
-				if(j < 0) {
+				if(j == (size_t)-1) {
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			directory = (dataw.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY);
@@ -1054,14 +1055,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					/* not a directory */
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 #else
 		if (save && php_sys_lstat(path, &st) < 0) {
 			if (use_realpath == CWD_REALPATH) {
 				/* file not found */
-				return -1;
+				return (size_t)-1;
 			}
 			/* continue resolution anyway but don't save result in the cache */
 			save = 0;
@@ -1071,30 +1072,30 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		memcpy(tmp, path, len+1);
 
 		if (save && S_ISLNK(st.st_mode)) {
-			if (++(*ll) > LINK_MAX || (j = php_sys_readlink(tmp, path, MAXPATHLEN)) < 0) {
+			if (++(*ll) > LINK_MAX || (j = (size_t)php_sys_readlink(tmp, path, MAXPATHLEN)) == (size_t)-1) {
 				/* too many links or broken symlinks */
 				free_alloca(tmp, use_heap);
-				return -1;
+				return (size_t)-1;
 			}
 			path[j] = 0;
 			if (IS_ABSOLUTE_PATH(path, j)) {
 				j = tsrm_realpath_r(path, 1, j, ll, t, use_realpath, is_dir, &directory);
-				if (j < 0) {
+				if (j == (size_t)-1) {
 					free_alloca(tmp, use_heap);
-					return -1;
+					return (size_t)-1;
 				}
 			} else {
 				if (i + j >= MAXPATHLEN-1) {
 					free_alloca(tmp, use_heap);
-					return -1; /* buffer overflow */
+					return (size_t)-1; /* buffer overflow */
 				}
 				memmove(path+i, path, j+1);
 				memcpy(path, tmp, i-1);
 				path[i-1] = DEFAULT_SLASH;
 				j = tsrm_realpath_r(path, start, i + j, ll, t, use_realpath, is_dir, &directory);
-				if (j < 0) {
+				if (j == (size_t)-1) {
 					free_alloca(tmp, use_heap);
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			if (link_is_dir) {
@@ -1109,11 +1110,11 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (is_dir && !directory) {
 					/* not a directory */
 					free_alloca(tmp, use_heap);
-					return -1;
+					return (size_t)-1;
 				}
 			}
 #endif
-			if (i - 1 <= start) {
+			if (i <= start + 1) {
 				j = start;
 			} else {
 				/* some leading directories may be unaccessable */
@@ -1123,10 +1124,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				}
 			}
 #ifdef ZEND_WIN32
-			if (j < 0 || j + len - i >= MAXPATHLEN-1) {
+			if (j == (size_t)-1 || j + len >= MAXPATHLEN - 1 + i) {
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 			if (save) {
 				size_t sz;
@@ -1134,9 +1135,9 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (!tmp_path) {
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
-				i = (int)sz;
+				i = sz;
 				memcpy(path+j, tmp_path, i+1);
 				free(tmp_path);
 				j += i;
@@ -1147,9 +1148,9 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			}
 		}
 #else
-			if (j < 0 || j + len - i >= MAXPATHLEN-1) {
+			if (j == (size_t)-1 || j + len >= MAXPATHLEN - 1 + i) {
 				free_alloca(tmp, use_heap);
-				return -1;
+				return (size_t)-1;
 			}
 			memcpy(path+j, tmp+i, len-i+1);
 			j += (len-i);
@@ -1175,16 +1176,16 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 /* returns 0 for ok, 1 for error */
 CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath) /* {{{ */
 {
-	int path_length = (int)strlen(path);
+	size_t path_length = strlen(path);
 	char resolved_path[MAXPATHLEN];
-	int start = 1;
+	size_t start = 1;
 	int ll = 0;
 	time_t t;
 	int ret;
 	int add_slash;
 	void *tmp;
 
-	if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
+	if (!path_length || path_length >= MAXPATHLEN-1) {
 #ifdef ZEND_WIN32
 		_set_errno(EINVAL);
 #else
@@ -1206,7 +1207,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 			start = 0;
 			memcpy(resolved_path , path, path_length + 1);
 		} else {
-			int state_cwd_length = state->cwd_length;
+			size_t state_cwd_length = state->cwd_length;
 
 #ifdef ZEND_WIN32
 			if (IS_SLASH(path[0])) {
@@ -1300,7 +1301,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	t = CWDG(realpath_cache_ttl) ? 0 : -1;
 	path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
 
-	if (path_length < 0) {
+	if (path_length == (size_t)-1) {
 		errno = ENOENT;
 		return 1;
 	}
@@ -1416,7 +1417,7 @@ CWD_API char *virtual_realpath(const char *path, char *real_path) /* {{{ */
 	}
 
 	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)==0) {
-		int len = new_state.cwd_length>MAXPATHLEN-1?MAXPATHLEN-1:new_state.cwd_length;
+		size_t len = new_state.cwd_length>MAXPATHLEN-1?MAXPATHLEN-1:new_state.cwd_length;
 
 		memcpy(real_path, new_state.cwd, len);
 		real_path[len] = '\0';
@@ -1880,7 +1881,7 @@ CWD_API char *tsrm_realpath(const char *path, char *real_path) /* {{{ */
 	} else if (!IS_ABSOLUTE_PATH(path, strlen(path)) &&
 					VCWD_GETCWD(cwd, MAXPATHLEN)) {
 		new_state.cwd = estrdup(cwd);
-		new_state.cwd_length = (int)strlen(cwd);
+		new_state.cwd_length = strlen(cwd);
 	} else {
 		new_state.cwd = (char*)emalloc(1);
 		new_state.cwd[0] = '\0';
@@ -1893,7 +1894,7 @@ CWD_API char *tsrm_realpath(const char *path, char *real_path) /* {{{ */
 	}
 
 	if (real_path) {
-		int copy_len = new_state.cwd_length>MAXPATHLEN-1 ? MAXPATHLEN-1 : new_state.cwd_length;
+		size_t copy_len = new_state.cwd_length>MAXPATHLEN-1 ? MAXPATHLEN-1 : new_state.cwd_length;
 		memcpy(real_path, new_state.cwd, copy_len);
 		real_path[copy_len] = '\0';
 		efree(new_state.cwd);