Move cwd_state and path related routines to size_t

Having `int` there is no real profit in the size or speed, while unsigned
improves security and overall integration. ZPP supplied strings can
be then accepted directly and structs can be still handled with smaller
unsigned types for size reasons, which is safe. Yet some related places
are to go.

basic move tsrm_realpath_r to size_t

fix conditions and sync with affected places

touch ocurrences of php_sys_readlink usage

follow up on phar path handling

remove duplicated check

move zend_resolve_path and related pieces to size_t

touch yet resolve path related places

remove cast

missing pieces

missing piece

yet cleanups for php_sys_readlink for ssize_t

fix wrong return

Zend/zend.c

@@ -75,7 +75,7 @@ ZEND_API void (*zend_error_cb)(int type, const char *error_filename, const uint3
 void (*zend_printf_to_smart_string)(smart_string *buf, const char *format, va_list ap);
 void (*zend_printf_to_smart_str)(smart_str *buf, const char *format, va_list ap);
 ZEND_API char *(*zend_getenv)(char *name, size_t name_len);
-ZEND_API zend_string *(*zend_resolve_path)(const char *filename, int filename_len);
+ZEND_API zend_string *(*zend_resolve_path)(const char *filename, size_t filename_len);
 
 void (*zend_on_timeout)(int seconds);
 

Zend/zend.h

@@ -189,7 +189,7 @@ typedef struct _zend_utility_functions {
 	void (*printf_to_smart_string_function)(smart_string *buf, const char *format, va_list ap);
 	void (*printf_to_smart_str_function)(smart_str *buf, const char *format, va_list ap);
 	char *(*getenv_function)(char *name, size_t name_len);
-	zend_string *(*resolve_path_function)(const char *filename, int filename_len);
+	zend_string *(*resolve_path_function)(const char *filename, size_t filename_len);
 } zend_utility_functions;
 
 typedef struct _zend_utility_values {
@@ -269,7 +269,7 @@ extern ZEND_API int (*zend_stream_open_function)(const char *filename, zend_file
 extern void (*zend_printf_to_smart_string)(smart_string *buf, const char *format, va_list ap);
 extern void (*zend_printf_to_smart_str)(smart_str *buf, const char *format, va_list ap);
 extern ZEND_API char *(*zend_getenv)(char *name, size_t name_len);
-extern ZEND_API zend_string *(*zend_resolve_path)(const char *filename, int filename_len);
+extern ZEND_API zend_string *(*zend_resolve_path)(const char *filename, size_t filename_len);
 
 ZEND_API ZEND_COLD void zend_error(int type, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
 ZEND_API ZEND_COLD void zend_throw_error(zend_class_entry *exception_ce, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);

Zend/zend_execute.c

@@ -2780,7 +2780,7 @@ static zend_never_inline zend_op_array* ZEND_FASTCALL zend_include_or_eval(zval
 					zend_file_handle file_handle;
 					zend_string *resolved_path;
 
-					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), (int)Z_STRLEN_P(inc_filename));
+					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename));
 					if (resolved_path) {
 						if (zend_hash_exists(&EG(included_files), resolved_path)) {
 							goto already_compiled;

Zend/zend_virtual_cwd.c

@@ -163,7 +163,7 @@ static inline time_t FileTimeToUnixTime(const FILETIME *FileTime)
 	return (time_t)UnixTime;
 }
 
-CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){ /* {{{ */
+CWD_API ssize_t php_sys_readlink(const char *link, char *target, size_t target_len){ /* {{{ */
 	HANDLE hFile;
 	wchar_t *linkw = php_win32_ioutil_any_to_w(link), targetw[MAXPATHLEN];
 	size_t ret_len, targetw_len, offset = 0;
@@ -229,7 +229,7 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
 	CloseHandle(hFile);
 	free(linkw);
 
-	return ret_len;
+	return (ssize_t)ret_len;
 }
 /* }}} */
 
@@ -404,7 +404,7 @@ CWD_API void virtual_cwd_startup(void) /* {{{ */
 		cwd[0] = '\0';
 	}
 
-	main_cwd_state.cwd_length = (int)strlen(cwd);
+	main_cwd_state.cwd_length = strlen(cwd);
 #ifdef ZEND_WIN32
 	if (main_cwd_state.cwd_length >= 2 && cwd[1] == ':') {
 		cwd[0] = toupper(cwd[0]);
@@ -706,10 +706,10 @@ CWD_API realpath_cache_bucket** realpath_cache_get_buckets(void)
 #undef LINK_MAX
 #define LINK_MAX 32
 
-static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, int use_realpath, int is_dir, int *link_is_dir) /* {{{ */
+static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, time_t *t, int use_realpath, int is_dir, int *link_is_dir) /* {{{ */
 {
-	int i, j, save;
+	size_t i, j;
-	int directory = 0;
+	int directory = 0, save;
 #ifdef ZEND_WIN32
 	WIN32_FIND_DATAW dataw;
 	HANDLE hFind = INVALID_HANDLE_VALUE;
@@ -739,7 +739,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		}
 
 		if (i == len ||
-			(i == len - 1 && path[i] == '.')) {
+			(i + 1 == len && path[i] == '.')) {
 			/* remove double slashes and '.' */
 			len = i - 1;
 			is_dir = 1;
@@ -750,7 +750,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			if (link_is_dir) {
 				*link_is_dir = 1;
 			}
-			if (i - 1 <= start) {
+			if (i <= start + 1) {
 				return start ? start : len;
 			}
 			j = tsrm_realpath_r(path, start, i-1, ll, t, use_realpath, 1, NULL);
@@ -798,7 +798,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			if ((bucket = realpath_cache_find(path, len, *t)) != NULL) {
 				if (is_dir && !bucket->is_dir) {
 					/* not a directory */
-					return -1;
+					return (size_t)-1;
 				} else {
 					if (link_is_dir) {
 						*link_is_dir = bucket->is_dir;
@@ -813,14 +813,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
-				return -1;
+				return (size_t)-1;
 			}
 			hFind = FindFirstFileExW(pathw, FindExInfoBasic, &dataw, FindExSearchNameMatch, NULL, 0);
 			if (INVALID_HANDLE_VALUE == hFind) {
 				if (use_realpath == CWD_REALPATH) {
 					/* file not found */
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				/* continue resolution anyway but don't save result in the cache */
 				save = 0;
@@ -840,7 +840,8 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			HANDLE hLink = NULL;
 			REPARSE_DATA_BUFFER * pbuffer;
 			DWORD retlength = 0;
-			int bufindex = 0, isabsolute = 0;
+			size_t bufindex = 0;
+			uint8_t isabsolute = 0;
 			wchar_t * reparsetarget;
 			BOOL isVolume = FALSE;
 #if VIRTUAL_CWD_DEBUG
@@ -848,20 +849,20 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 #endif
 			char *substitutename = NULL;
 			size_t substitutename_len;
-			int substitutename_off = 0;
+			size_t substitutename_off = 0;
 			wchar_t tmpsubstname[MAXPATHLEN];
 
 			if(++(*ll) > LINK_MAX) {
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			hLink = CreateFileW(pathw, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
 			if(hLink == INVALID_HANDLE_VALUE) {
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			pbuffer = (REPARSE_DATA_BUFFER *)do_alloca(MAXIMUM_REPARSE_DATA_BUFFER_SIZE, use_heap_large);
@@ -869,14 +870,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				CloseHandle(hLink);
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
 				free_alloca(pbuffer, use_heap_large);
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			CloseHandle(hLink);
@@ -890,7 +891,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 #endif
 
@@ -899,7 +900,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength);
 				tmpsubstname[substitutename_len] = L'\0';
@@ -912,7 +913,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free(printname);
 #endif
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			else if(pbuffer->ReparseTag == IO_REPARSE_TAG_MOUNT_POINT) {
@@ -924,7 +925,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 #endif
 
@@ -934,7 +935,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength);
 				tmpsubstname[substitutename_len] = L'\0';
@@ -947,7 +948,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free(printname);
 #endif
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP) {
@@ -957,7 +958,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					free_alloca(pbuffer, use_heap_large);
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 				memcpy(substitutename, path, len + 1);
 				substitutename_len = len;
@@ -966,7 +967,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				free_alloca(pbuffer, use_heap_large);
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 
 			if(isabsolute && substitutename_len > 4) {
@@ -993,7 +994,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 
 			if (!isVolume) {
 				char * tmp2 = substitutename + substitutename_off;
-				for(bufindex = 0; bufindex < (substitutename_len - substitutename_off); bufindex++) {
+				for (bufindex = 0; bufindex + substitutename_off < substitutename_len; bufindex++) {
 					*(path + bufindex) = *(tmp2 + bufindex);
 				}
 
@@ -1017,10 +1018,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
 					j = tsrm_realpath_r(path, 0, j, ll, t, 0, is_dir, &directory);
-					if(j < 0) {
+					if(j == (size_t)-1) {
 						free_alloca(tmp, use_heap);
 						FREE_PATHW()
-						return -1;
+						return (size_t)-1;
 					}
 				}
 			}
@@ -1028,17 +1029,17 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if(i + j >= MAXPATHLEN - 1) {
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 
 				memmove(path+i, path, j+1);
 				memcpy(path, tmp, i-1);
 				path[i-1] = DEFAULT_SLASH;
 				j  = tsrm_realpath_r(path, start, i + j, ll, t, use_realpath, is_dir, &directory);
-				if(j < 0) {
+				if(j == (size_t)-1) {
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			directory = (dataw.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY);
@@ -1054,14 +1055,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					/* not a directory */
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
 			}
 #else
 		if (save && php_sys_lstat(path, &st) < 0) {
 			if (use_realpath == CWD_REALPATH) {
 				/* file not found */
-				return -1;
+				return (size_t)-1;
 			}
 			/* continue resolution anyway but don't save result in the cache */
 			save = 0;
@@ -1071,30 +1072,30 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		memcpy(tmp, path, len+1);
 
 		if (save && S_ISLNK(st.st_mode)) {
-			if (++(*ll) > LINK_MAX || (j = php_sys_readlink(tmp, path, MAXPATHLEN)) < 0) {
+			if (++(*ll) > LINK_MAX || (j = (size_t)php_sys_readlink(tmp, path, MAXPATHLEN)) == (size_t)-1) {
 				/* too many links or broken symlinks */
 				free_alloca(tmp, use_heap);
-				return -1;
+				return (size_t)-1;
 			}
 			path[j] = 0;
 			if (IS_ABSOLUTE_PATH(path, j)) {
 				j = tsrm_realpath_r(path, 1, j, ll, t, use_realpath, is_dir, &directory);
-				if (j < 0) {
+				if (j == (size_t)-1) {
 					free_alloca(tmp, use_heap);
-					return -1;
+					return (size_t)-1;
 				}
 			} else {
 				if (i + j >= MAXPATHLEN-1) {
 					free_alloca(tmp, use_heap);
-					return -1; /* buffer overflow */
+					return (size_t)-1; /* buffer overflow */
 				}
 				memmove(path+i, path, j+1);
 				memcpy(path, tmp, i-1);
 				path[i-1] = DEFAULT_SLASH;
 				j = tsrm_realpath_r(path, start, i + j, ll, t, use_realpath, is_dir, &directory);
-				if (j < 0) {
+				if (j == (size_t)-1) {
 					free_alloca(tmp, use_heap);
-					return -1;
+					return (size_t)-1;
 				}
 			}
 			if (link_is_dir) {
@@ -1109,11 +1110,11 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (is_dir && !directory) {
 					/* not a directory */
 					free_alloca(tmp, use_heap);
-					return -1;
+					return (size_t)-1;
 				}
 			}
 #endif
-			if (i - 1 <= start) {
+			if (i <= start + 1) {
 				j = start;
 			} else {
 				/* some leading directories may be unaccessable */
@@ -1123,10 +1124,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				}
 			}
 #ifdef ZEND_WIN32
-			if (j < 0 || j + len - i >= MAXPATHLEN-1) {
+			if (j == (size_t)-1 || j + len >= MAXPATHLEN - 1 + i) {
 				free_alloca(tmp, use_heap);
 				FREE_PATHW()
-				return -1;
+				return (size_t)-1;
 			}
 			if (save) {
 				size_t sz;
@@ -1134,9 +1135,9 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (!tmp_path) {
 					free_alloca(tmp, use_heap);
 					FREE_PATHW()
-					return -1;
+					return (size_t)-1;
 				}
-				i = (int)sz;
+				i = sz;
 				memcpy(path+j, tmp_path, i+1);
 				free(tmp_path);
 				j += i;
@@ -1147,9 +1148,9 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			}
 		}
 #else
-			if (j < 0 || j + len - i >= MAXPATHLEN-1) {
+			if (j == (size_t)-1 || j + len >= MAXPATHLEN - 1 + i) {
 				free_alloca(tmp, use_heap);
-				return -1;
+				return (size_t)-1;
 			}
 			memcpy(path+j, tmp+i, len-i+1);
 			j += (len-i);
@@ -1175,16 +1176,16 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 /* returns 0 for ok, 1 for error */
 CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath) /* {{{ */
 {
-	int path_length = (int)strlen(path);
+	size_t path_length = strlen(path);
 	char resolved_path[MAXPATHLEN];
-	int start = 1;
+	size_t start = 1;
 	int ll = 0;
 	time_t t;
 	int ret;
 	int add_slash;
 	void *tmp;
 
-	if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
+	if (!path_length || path_length >= MAXPATHLEN-1) {
 #ifdef ZEND_WIN32
 		_set_errno(EINVAL);
 #else
@@ -1206,7 +1207,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 			start = 0;
 			memcpy(resolved_path , path, path_length + 1);
 		} else {
-			int state_cwd_length = state->cwd_length;
+			size_t state_cwd_length = state->cwd_length;
 
 #ifdef ZEND_WIN32
 			if (IS_SLASH(path[0])) {
@@ -1300,7 +1301,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	t = CWDG(realpath_cache_ttl) ? 0 : -1;
 	path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
 
-	if (path_length < 0) {
+	if (path_length == (size_t)-1) {
 		errno = ENOENT;
 		return 1;
 	}
@@ -1416,7 +1417,7 @@ CWD_API char *virtual_realpath(const char *path, char *real_path) /* {{{ */
 	}
 
 	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)==0) {
-		int len = new_state.cwd_length>MAXPATHLEN-1?MAXPATHLEN-1:new_state.cwd_length;
+		size_t len = new_state.cwd_length>MAXPATHLEN-1?MAXPATHLEN-1:new_state.cwd_length;
 
 		memcpy(real_path, new_state.cwd, len);
 		real_path[len] = '\0';
@@ -1880,7 +1881,7 @@ CWD_API char *tsrm_realpath(const char *path, char *real_path) /* {{{ */
 	} else if (!IS_ABSOLUTE_PATH(path, strlen(path)) &&
 					VCWD_GETCWD(cwd, MAXPATHLEN)) {
 		new_state.cwd = estrdup(cwd);
-		new_state.cwd_length = (int)strlen(cwd);
+		new_state.cwd_length = strlen(cwd);
 	} else {
 		new_state.cwd = (char*)emalloc(1);
 		new_state.cwd[0] = '\0';
@@ -1893,7 +1894,7 @@ CWD_API char *tsrm_realpath(const char *path, char *real_path) /* {{{ */
 	}
 
 	if (real_path) {
-		int copy_len = new_state.cwd_length>MAXPATHLEN-1 ? MAXPATHLEN-1 : new_state.cwd_length;
+		size_t copy_len = new_state.cwd_length>MAXPATHLEN-1 ? MAXPATHLEN-1 : new_state.cwd_length;
 		memcpy(real_path, new_state.cwd, copy_len);
 		real_path[copy_len] = '\0';
 		efree(new_state.cwd);

Zend/zend_virtual_cwd.h

@@ -121,7 +121,7 @@ typedef unsigned short mode_t;
 CWD_API int php_sys_stat_ex(const char *path, zend_stat_t *buf, int lstat);
 # define php_sys_stat(path, buf) php_sys_stat_ex(path, buf, 0)
 # define php_sys_lstat(path, buf) php_sys_stat_ex(path, buf, 1)
-CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len);
+CWD_API ssize_t php_sys_readlink(const char *link, char *target, size_t target_len);
 #else
 # define php_sys_stat stat
 # define php_sys_lstat lstat
@@ -132,7 +132,7 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len);
 
 typedef struct _cwd_state {
 	char *cwd;
-	int cwd_length;
+	size_t cwd_length;
 } cwd_state;
 
 typedef int (*verify_path_func)(const cwd_state *);

ext/opcache/ZendAccelerator.c

@@ -114,7 +114,7 @@ zend_bool fallback_process = 0; /* process uses file cache fallback */
 
 static zend_op_array *(*accelerator_orig_compile_file)(zend_file_handle *file_handle, int type);
 static int (*accelerator_orig_zend_stream_open_function)(const char *filename, zend_file_handle *handle );
-static zend_string *(*accelerator_orig_zend_resolve_path)(const char *filename, int filename_len);
+static zend_string *(*accelerator_orig_zend_resolve_path)(const char *filename, size_t filename_len);
 static zif_handler orig_chdir = NULL;
 static ZEND_INI_MH((*orig_include_path_on_modify)) = NULL;
 
@@ -1015,7 +1015,7 @@ int validate_timestamp_and_record_ex(zend_persistent_script *persistent_script,
 /* Instead of resolving full real path name each time we need to identify file,
  * we create a key that consist from requested file name, current working
  * directory, current include_path, etc */
-char *accel_make_persistent_key(const char *path, int path_length, int *key_len)
+char *accel_make_persistent_key(const char *path, size_t path_length, int *key_len)
 {
 	int key_length;
 
@@ -1171,7 +1171,7 @@ char *accel_make_persistent_key(const char *path, int path_length, int *key_len)
 	return (char*)path;
 }
 
-int zend_accel_invalidate(const char *filename, int filename_len, zend_bool force)
+int zend_accel_invalidate(const char *filename, size_t filename_len, zend_bool force)
 {
 	zend_string *realpath;
 	zend_persistent_script *persistent_script;
@@ -2018,7 +2018,7 @@ static int persistent_stream_open_function(const char *filename, zend_file_handl
 }
 
 /* zend_resolve_path() replacement for PHP 5.3 and above */
-static zend_string* persistent_zend_resolve_path(const char *filename, int filename_len)
+static zend_string* persistent_zend_resolve_path(const char *filename, size_t filename_len)
 {
 	if (ZCG(enabled) && accel_startup_ok &&
 	    (ZCG(counted) || ZCSG(accelerator_enabled)) &&

ext/opcache/ZendAccelerator.h

@@ -310,11 +310,11 @@ void zend_accel_schedule_restart_if_necessary(zend_accel_restart_reason reason);
 accel_time_t zend_get_file_handle_timestamp(zend_file_handle *file_handle, size_t *size);
 int  validate_timestamp_and_record(zend_persistent_script *persistent_script, zend_file_handle *file_handle);
 int  validate_timestamp_and_record_ex(zend_persistent_script *persistent_script, zend_file_handle *file_handle);
-int  zend_accel_invalidate(const char *filename, int filename_len, zend_bool force);
+int  zend_accel_invalidate(const char *filename, size_t filename_len, zend_bool force);
 int  accelerator_shm_read_lock(void);
 void accelerator_shm_read_unlock(void);
 
-char *accel_make_persistent_key(const char *path, int path_length, int *key_len);
+char *accel_make_persistent_key(const char *path, size_t path_length, int *key_len);
 zend_op_array *persistent_compile_file(zend_file_handle *file_handle, int type);
 
 #define IS_ACCEL_INTERNED(str) \

ext/phar/phar.c

@@ -27,7 +27,7 @@
 static void destroy_phar_data(zval *zv);
 
 ZEND_DECLARE_MODULE_GLOBALS(phar)
-zend_string *(*phar_save_resolve_path)(const char *filename, int filename_len);
+zend_string *(*phar_save_resolve_path)(const char *filename, size_t filename_len);
 
 /**
  * set's phar->is_writeable based on the current INI value
@@ -3249,7 +3249,7 @@ static size_t phar_zend_stream_fsizer(void *handle) /* {{{ */
 zend_op_array *(*phar_orig_compile_file)(zend_file_handle *file_handle, int type);
 #define phar_orig_zend_open zend_stream_open_function
 
-static zend_string *phar_resolve_path(const char *filename, int filename_len)
+static zend_string *phar_resolve_path(const char *filename, size_t filename_len)
 {
 	return phar_find_in_include_path((char *) filename, filename_len, NULL);
 }

ext/phar/phar_object.c

@@ -4164,7 +4164,7 @@ PHP_METHOD(Phar, delMetadata)
 }
 /* }}} */
 
-static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *dest, int dest_len, char **error) /* {{{ */
+static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *dest, size_t dest_len, char **error) /* {{{ */
 {
 	php_stream_statbuf ssb;
 	size_t len;
@@ -4206,13 +4206,13 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 #ifdef PHP_WIN32
 	/* unixify the path back, otherwise non zip formats might be broken */
 	{
-		int cnt = filename_len;
+		size_t cnt = 0;
 
 		do {
 			if ('\\' == filename[cnt]) {
 				filename[cnt] = '/';
 			}
-		} while (cnt-- >= 0);
+		} while (cnt++ < filename_len);
 	}
 #endif
 
@@ -4433,7 +4433,7 @@ PHP_METHOD(Phar, extractTo)
 							zend_throw_exception_ex(phar_ce_PharException, 0,
 								"Phar Error: attempted to extract non-existent file \"%s\" from phar \"%s\"", Z_STRVAL_P(zval_file), phar_obj->archive->fname);
 						}
-						if (FAILURE == phar_extract_file(overwrite, entry, pathto, (int)pathto_len, &error)) {
+						if (FAILURE == phar_extract_file(overwrite, entry, pathto, pathto_len, &error)) {
 							zend_throw_exception_ex(phar_ce_PharException, 0,
 								"Extraction from phar \"%s\" failed: %s", phar_obj->archive->fname, error);
 							efree(error);
@@ -4454,7 +4454,7 @@ PHP_METHOD(Phar, extractTo)
 			return;
 		}
 
-		if (FAILURE == phar_extract_file(overwrite, entry, pathto, (int)pathto_len, &error)) {
+		if (FAILURE == phar_extract_file(overwrite, entry, pathto, pathto_len, &error)) {
 			zend_throw_exception_ex(phar_ce_PharException, 0,
 				"Extraction from phar \"%s\" failed: %s", phar_obj->archive->fname, error);
 			efree(error);
@@ -4470,7 +4470,7 @@ all_files:
 		}
 
 		ZEND_HASH_FOREACH_PTR(&phar->manifest, entry) {
-			if (FAILURE == phar_extract_file(overwrite, entry, pathto, (int)pathto_len, &error)) {
+			if (FAILURE == phar_extract_file(overwrite, entry, pathto, pathto_len, &error)) {
 				zend_throw_exception_ex(phar_ce_PharException, 0,
 					"Extraction from phar \"%s\" failed: %s", phar->fname, error);
 				efree(error);

ext/spl/spl_directory.c

@@ -1235,7 +1235,7 @@ FileInfoFunction(isLink, FS_IS_LINK)
 SPL_METHOD(SplFileInfo, getLinkTarget)
 {
 	spl_filesystem_object *intern = Z_SPLFILESYSTEM_P(getThis());
-	int ret;
+	ssize_t ret;
 	char buff[MAXPATHLEN];
 	zend_error_handling error_handling;
 

ext/standard/link.c

@@ -57,7 +57,7 @@ PHP_FUNCTION(readlink)
 	char *link;
 	size_t link_len;
 	char buff[MAXPATHLEN];
-	int ret;
+	ssize_t ret;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_PATH(link, link_len)

ext/standard/link_win32.c

@@ -63,7 +63,7 @@ TODO:
 PHP_FUNCTION(readlink)
 {
 	char *link;
-	size_t link_len;
+	ssize_t link_len;
 	char target[MAXPATHLEN];
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &link, &link_len) == FAILURE) {
@@ -74,7 +74,8 @@ PHP_FUNCTION(readlink)
 		RETURN_FALSE;
 	}
 
-	if (php_sys_readlink(link, target, MAXPATHLEN) == -1) {
+	link_len = php_sys_readlink(link, target, MAXPATHLEN);
+	if (link_len == -1) {
 		php_error_docref(NULL, E_WARNING, "readlink failed to read the symbolic link (%s), error %d)", link, GetLastError());
 		RETURN_FALSE;
 	}

ext/standard/streamsfuncs.c

@@ -1559,7 +1559,7 @@ PHP_FUNCTION(stream_resolve_include_path)
 		Z_PARAM_PATH(filename, filename_len)
 	ZEND_PARSE_PARAMETERS_END();
 
-	resolved_path = zend_resolve_path(filename, (int)filename_len);
+	resolved_path = zend_resolve_path(filename, filename_len);
 
 	if (resolved_path) {
 		RETURN_STR(resolved_path);

ext/zip/php_zip.c

@@ -137,18 +137,18 @@ static char * php_zip_make_relative_path(char *path, size_t path_len) /* {{{ */
 # define CWD_STATE_FREE(s)  efree(s)
 
 /* {{{ php_zip_extract_file */
-static int php_zip_extract_file(struct zip * za, char *dest, char *file, int file_len)
+static int php_zip_extract_file(struct zip * za, char *dest, char *file, size_t file_len)
 {
 	php_stream_statbuf ssb;
 	struct zip_file *zf;
 	struct zip_stat sb;
 	char b[8192];
-	int n, len, ret;
+	int n, ret;
 	php_stream *stream;
 	char *fullpath;
 	char *file_dirname_fullpath;
 	char file_dirname[MAXPATHLEN];
-	size_t dir_len;
+	size_t dir_len, len;
 	int is_dir_only = 0;
 	char *path_cleaned;
 	size_t path_cleaned_len;
@@ -181,7 +181,7 @@ static int php_zip_extract_file(struct zip * za, char *dest, char *file, int fil
 		memcpy(file_dirname, path_cleaned, path_cleaned_len);
 		dir_len = php_dirname(file_dirname, path_cleaned_len);
 
-		if (dir_len <= 0 || (dir_len == 1 && file_dirname[0] == '.')) {
+		if (!dir_len || (dir_len == 1 && file_dirname[0] == '.')) {
 			len = spprintf(&file_dirname_fullpath, 0, "%s", dest);
 		} else {
 			len = spprintf(&file_dirname_fullpath, 0, "%s/%s", dest, file_dirname);

main/fopen_wrappers.c

@@ -168,11 +168,11 @@ PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path
 	while (VCWD_REALPATH(path_tmp, resolved_name) == NULL) {
 #if defined(PHP_WIN32) || defined(HAVE_SYMLINK)
 		if (nesting_level == 0) {
-			int ret;
+			ssize_t ret;
 			char buf[MAXPATHLEN];
 
 			ret = php_sys_readlink(path_tmp, buf, MAXPATHLEN - 1);
-			if (ret < 0) {
+			if (ret == -1) {
 				/* not a broken symlink, move along.. */
 			} else {
 				/* put the real path into the path buffer */
@@ -355,7 +355,7 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
 	char *path_info;
 	char *filename = NULL;
 	zend_string *resolved_path = NULL;
-	int length;
+	size_t length;
 	zend_bool orig_display_errors;
 
 	path_info = SG(request_info).request_uri;
@@ -378,7 +378,7 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
 			pwbuf = emalloc(pwbuflen);
 #endif
 			length = s - (path_info + 2);
-			if (length > (int)sizeof(user) - 1) {
+			if (length > sizeof(user) - 1) {
 				length = sizeof(user) - 1;
 			}
 			memcpy(user, path_info + 2, length);
@@ -402,9 +402,9 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
 		}
 	} else
 #endif
-	if (PG(doc_root) && path_info && (length = (int)strlen(PG(doc_root))) &&
+	if (PG(doc_root) && path_info && (length = strlen(PG(doc_root))) &&
 		IS_ABSOLUTE_PATH(PG(doc_root), length)) {
-		int path_len = (int)strlen(path_info);
+		size_t path_len = strlen(path_info);
 		filename = emalloc(length + path_len + 2);
 		memcpy(filename, PG(doc_root), length);
 		if (!IS_SLASH(filename[length - 1])) {	/* length is never 0 */
@@ -420,7 +420,7 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
 
 
 	if (filename) {
-		resolved_path = zend_resolve_path(filename, (int)strlen(filename));
+		resolved_path = zend_resolve_path(filename, strlen(filename));
 	}
 
 	if (!resolved_path) {
@@ -472,7 +472,7 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
 /* {{{ php_resolve_path
  * Returns the realpath for given filename according to include path
  */
-PHPAPI zend_string *php_resolve_path(const char *filename, int filename_length, const char *path)
+PHPAPI zend_string *php_resolve_path(const char *filename, size_t filename_length, const char *path)
 {
 	char resolved_path[MAXPATHLEN];
 	char trypath[MAXPATHLEN];
@@ -532,7 +532,7 @@ PHPAPI zend_string *php_resolve_path(const char *filename, int filename_length,
 		}
 		end = strchr(p, DEFAULT_DIR_SEPARATOR);
 		if (end) {
-			if (filename_length > (MAXPATHLEN - 2) || (end-ptr) > MAXPATHLEN || (end-ptr) + 1 + (size_t)filename_length + 1 >= MAXPATHLEN) {
+			if (filename_length > (MAXPATHLEN - 2) || (end-ptr) > MAXPATHLEN || (end-ptr) + 1 + filename_length + 1 >= MAXPATHLEN) {
 				ptr = end + 1;
 				continue;
 			}
@@ -543,7 +543,7 @@ PHPAPI zend_string *php_resolve_path(const char *filename, int filename_length,
 		} else {
 			size_t len = strlen(ptr);
 
-			if (filename_length > (MAXPATHLEN - 2) || len > MAXPATHLEN || len + 1 + (size_t)filename_length + 1 >= MAXPATHLEN) {
+			if (filename_length > (MAXPATHLEN - 2) || len > MAXPATHLEN || len + 1 + filename_length + 1 >= MAXPATHLEN) {
 				break;
 			}
 			memcpy(trypath, ptr, len);
@@ -624,7 +624,7 @@ PHPAPI FILE *php_fopen_with_path(const char *filename, const char *mode, const c
 	char *pathbuf, *ptr, *end;
 	char trypath[MAXPATHLEN];
 	FILE *fp;
-	int filename_length;
+	size_t filename_length;
 	zend_string *exec_filename;
 
 	if (opened_path) {
@@ -635,7 +635,7 @@ PHPAPI FILE *php_fopen_with_path(const char *filename, const char *mode, const c
 		return NULL;
 	}
 
-	filename_length = (int)strlen(filename);
+	filename_length = strlen(filename);
 #ifndef PHP_WIN32
 	(void) filename_length;
 #endif
@@ -761,14 +761,14 @@ PHPAPI char *expand_filepath_with_mode(const char *filepath, char *real_path, co
 {
 	cwd_state new_state;
 	char cwd[MAXPATHLEN];
-	int copy_len;
+	size_t copy_len;
-	int path_len;
+	size_t path_len;
 
 	if (!filepath[0]) {
 		return NULL;
 	}
 
-	path_len = (int)strlen(filepath);
+	path_len = strlen(filepath);
 
 	if (IS_ABSOLUTE_PATH(filepath, path_len)) {
 		cwd[0] = '\0';
@@ -811,7 +811,7 @@ PHPAPI char *expand_filepath_with_mode(const char *filepath, char *real_path, co
 	}
 
 	new_state.cwd = estrdup(cwd);
-	new_state.cwd_length = (int)strlen(cwd);
+	new_state.cwd_length = strlen(cwd);
 
 	if (virtual_file_ex(&new_state, filepath, NULL, realpath_mode)) {
 		efree(new_state.cwd);

main/fopen_wrappers.h

@@ -39,7 +39,7 @@ PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path
 
 PHPAPI int php_check_safe_mode_include_dir(const char *path);
 
-PHPAPI zend_string *php_resolve_path(const char *filename, int filename_len, const char *path);
+PHPAPI zend_string *php_resolve_path(const char *filename, size_t filename_len, const char *path);
 
 PHPAPI FILE *php_fopen_with_path(const char *filename, const char *mode, const char *path, zend_string **opened_path);
 

main/main.c

@@ -1427,7 +1427,7 @@ PHPAPI int php_stream_open_for_zend_ex(const char *filename, zend_file_handle *h
 }
 /* }}} */
 
-static zend_string *php_resolve_path_for_zend(const char *filename, int filename_len) /* {{{ */
+static zend_string *php_resolve_path_for_zend(const char *filename, size_t filename_len) /* {{{ */
 {
 	return php_resolve_path(filename, filename_len, PG(include_path));
 }

main/php_open_temporary_file.c

@@ -125,7 +125,7 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, zend_st
 	}
 
 	new_state.cwd = estrdup(cwd);
-	new_state.cwd_length = (int)strlen(cwd);
+	new_state.cwd_length = strlen(cwd);
 
 	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)) {
 		efree(new_state.cwd);
@@ -216,7 +216,7 @@ PHPAPI const char* php_get_temporary_directory(void)
 	{
 		char *sys_temp_dir = PG(sys_temp_dir);
 		if (sys_temp_dir) {
-			int len = (int)strlen(sys_temp_dir);
+			size_t len = strlen(sys_temp_dir);
 			if (len >= 2 && sys_temp_dir[len - 1] == DEFAULT_SLASH) {
 				PG(php_sys_temp_dir) = estrndup(sys_temp_dir, len - 1);
 				return PG(php_sys_temp_dir);
@@ -237,7 +237,10 @@ PHPAPI const char* php_get_temporary_directory(void)
 		wchar_t sTemp[MAXPATHLEN];
 		char *tmp;
 		size_t len = GetTempPathW(MAXPATHLEN, sTemp);
-		assert(0 < len);  /* should *never* fail! */
+
+		if (!len) {
+			return NULL;
+		}
 
 		if (NULL == (tmp = php_win32_ioutil_conv_w_to_any(sTemp, len, &len))) {
 			return NULL;
@@ -253,7 +256,7 @@ PHPAPI const char* php_get_temporary_directory(void)
 	{
 		char* s = getenv("TMPDIR");
 		if (s && *s) {
-			int len = strlen(s);
+			size_t len = strlen(s);
 
 			if (s[len - 1] == DEFAULT_SLASH) {
 				PG(php_sys_temp_dir) = estrndup(s, len - 1);

main/streams/streams.c

@@ -1996,7 +1996,7 @@ PHPAPI php_stream *_php_stream_open_wrapper_ex(const char *path, const char *mod
 	}
 
 	if (options & USE_PATH) {
-		resolved_path = zend_resolve_path(path, (int)strlen(path));
+		resolved_path = zend_resolve_path(path, strlen(path));
 		if (resolved_path) {
 			path = ZSTR_VAL(resolved_path);
 			/* we've found this file, don't re-check include_path or run realpath */