diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-05-09 21:55:29 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-05-09 21:55:29 -0700 |
| commit | abd159cce48f3e34f08e4751c568e09677d5ec9c (patch) | |
| tree | d1e85639144aab8e3d315c21fe5ad262401acfea /ext/standard/file.c | |
| parent | 95ed19ae28009aa7b3ed42d5760478de82640560 (diff) | |
| download | php-git-abd159cce48f3e34f08e4751c568e09677d5ec9c.tar.gz | |
Fix bug #72114 - int/size_t confusion in fread
Diffstat (limited to 'ext/standard/file.c')
| -rw-r--r-- | ext/standard/file.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ext/standard/file.c b/ext/standard/file.c index 0abc022ca6..e39c84f1cd 100644 --- a/ext/standard/file.c +++ b/ext/standard/file.c @@ -1758,6 +1758,12 @@ PHPAPI PHP_FUNCTION(fread) RETURN_FALSE; } + if (len > INT_MAX) { + /* string length is int in 5.x so we can not read more than int */ + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX); + RETURN_FALSE; + } + Z_STRVAL_P(return_value) = emalloc(len + 1); Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len); |