From e583890af04454bf2e4430a76c61e0a58cdd42d3 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Sat, 12 Oct 2024 04:55:45 +0100
Subject: [PATCH] Fix socket_recvfrom overflow on buffer size.

when passing PHP_INT_MAX for the $length param we get this (with ubsan)

`ext/sockets/sockets.c:1409:36: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long int'`

close GH-16382
---
 NEWS                                        |  3 +++
 ext/sockets/sockets.c                       |  3 ++-
 ext/sockets/tests/socket_recv_overflow.phpt | 19 +++++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 ext/sockets/tests/socket_recv_overflow.phpt

diff --git a/NEWS b/NEWS
index 555086e554e..b7d97636f56 100644
--- a/NEWS
+++ b/NEWS
@@ -36,6 +36,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
     (nielsdos)
 
+- Sockets:
+  . Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)
+
 - SPL:
   . Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos)
 
diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c
index f1a62c71929..2430b10977e 100644
--- a/ext/sockets/sockets.c
+++ b/ext/sockets/sockets.c
@@ -1402,7 +1402,8 @@ PHP_FUNCTION(socket_recvfrom)
 
 	/* overflow check */
 	/* Shouldthrow ? */
-	if ((arg3 + 2) < 3) {
+
+	if (arg3 <= 0 || arg3 > ZEND_LONG_MAX - 1) {
 		RETURN_FALSE;
 	}
 
diff --git a/ext/sockets/tests/socket_recv_overflow.phpt b/ext/sockets/tests/socket_recv_overflow.phpt
new file mode 100644
index 00000000000..9b3f7a0bbb5
--- /dev/null
+++ b/ext/sockets/tests/socket_recv_overflow.phpt
@@ -0,0 +1,19 @@
+--TEST--
+socket_recvfrom overflow on length argument
+--EXTENSIONS--
+sockets
+--SKIPIF--
+<?php
+if (strtolower(substr(PHP_OS, 0, 3)) === 'win') {
+    die('skip not valid for Windows.');
+}
+--FILE--
+<?php
+$s = socket_create(AF_UNIX, SOCK_DGRAM, 0);
+$buf = $end = "";
+var_dump(socket_recvfrom($s, $buf, PHP_INT_MAX, 0, $end));
+var_dump(socket_recvfrom($s, $buf, -1, 0, $end));
+?>
+--EXPECT--
+bool(false)
+bool(false)