diff --git a/NEWS b/NEWS index c11ddcdf44f..7b2ec767e12 100644 --- a/NEWS +++ b/NEWS @@ -41,6 +41,9 @@ PHP NEWS . Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params). (nielsdos) +- Sockets: + . Fixed bug with overflow socket_recvfrom $length argument. (David Carlier) + - SPL: . Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos) diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c index addcebbeda2..48221479a79 100644 --- a/ext/sockets/sockets.c +++ b/ext/sockets/sockets.c @@ -1452,7 +1452,8 @@ PHP_FUNCTION(socket_recvfrom) /* overflow check */ /* Shouldthrow ? */ - if ((arg3 + 2) < 3) { + + if (arg3 <= 0 || arg3 > ZEND_LONG_MAX - 1) { RETURN_FALSE; } diff --git a/ext/sockets/tests/socket_recv_overflow.phpt b/ext/sockets/tests/socket_recv_overflow.phpt new file mode 100644 index 00000000000..9b3f7a0bbb5 --- /dev/null +++ b/ext/sockets/tests/socket_recv_overflow.phpt @@ -0,0 +1,19 @@ +--TEST-- +socket_recvfrom overflow on length argument +--EXTENSIONS-- +sockets +--SKIPIF-- + +--EXPECT-- +bool(false) +bool(false)