diff options
| author | Michael Wallner <mike@php.net> | 2014-07-02 09:55:15 +0200 |
|---|---|---|
| committer | Michael Wallner <mike@php.net> | 2014-07-02 09:55:15 +0200 |
| commit | 1e06c73192c64ecc601ad265ed5666e90048c4b4 (patch) | |
| tree | 51586a60e3acef4959fb8825ca1dc1db23077a2b /ext/standard/streamsfuncs.c | |
| parent | 2e02f18b154bb00279e5d121cc36beea7b9b8f37 (diff) | |
| parent | 34e686c5562bfd289d330f5dae2dafec4e58a20c (diff) | |
| download | php-git-1e06c73192c64ecc601ad265ed5666e90048c4b4.tar.gz | |
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
fix integer overflow in {stream,file}_{get,put}_contents()
Diffstat (limited to 'ext/standard/streamsfuncs.c')
| -rw-r--r-- | ext/standard/streamsfuncs.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index b623447651..6876792d63 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -407,7 +407,7 @@ PHP_FUNCTION(stream_get_contents) zval *zsrc; long maxlen = PHP_STREAM_COPY_ALL, desiredpos = -1L; - int len; + long len; char *contents = NULL; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll", &zsrc, &maxlen, &desiredpos) == FAILURE) { @@ -439,6 +439,10 @@ PHP_FUNCTION(stream_get_contents) len = php_stream_copy_to_mem(stream, &contents, maxlen, 0); if (contents) { + if (len > INT_MAX) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %ld to %d bytes", len, INT_MAX); + len = INT_MAX; + } RETVAL_STRINGL(contents, len, 0); } else { RETVAL_EMPTY_STRING(); |