diff options
| author | Michael Wallner <mike@php.net> | 2014-07-02 09:56:05 +0200 |
|---|---|---|
| committer | Michael Wallner <mike@php.net> | 2014-07-02 09:56:05 +0200 |
| commit | 122ee0a1cf2b31ae2497fada3900848382fbfb70 (patch) | |
| tree | 2acf976c47e1920512abc269a75a7919b0df5eb1 /ext/standard/streamsfuncs.c | |
| parent | d5d95f89351a72db7108d05fc9a86c949d4d5084 (diff) | |
| parent | 1e06c73192c64ecc601ad265ed5666e90048c4b4 (diff) | |
| download | php-git-122ee0a1cf2b31ae2497fada3900848382fbfb70.tar.gz | |
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
fix integer overflow in {stream,file}_{get,put}_contents()
Diffstat (limited to 'ext/standard/streamsfuncs.c')
| -rw-r--r-- | ext/standard/streamsfuncs.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index 68b4cceaaa..8df4be7fac 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -409,7 +409,7 @@ PHP_FUNCTION(stream_get_contents) zval *zsrc; long maxlen = PHP_STREAM_COPY_ALL, desiredpos = -1L; - int len; + long len; char *contents = NULL; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll", &zsrc, &maxlen, &desiredpos) == FAILURE) { @@ -441,6 +441,10 @@ PHP_FUNCTION(stream_get_contents) len = php_stream_copy_to_mem(stream, &contents, maxlen, 0); if (contents) { + if (len > INT_MAX) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %ld to %d bytes", len, INT_MAX); + len = INT_MAX; + } RETVAL_STRINGL(contents, len, 0); } else { RETVAL_EMPTY_STRING(); |