diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c index 5d523f596fb..9d3013c62d9 100644 --- a/ext/spl/spl_directory.c +++ b/ext/spl/spl_directory.c @@ -2686,6 +2686,12 @@ PHP_METHOD(SplFileObject, ftruncate) CHECK_SPL_FILE_OBJECT_IS_INITIALIZED(intern); + if (size < 0) { + zend_argument_value_error(1, "must be greater than or equal to 0"); + RETURN_THROWS(); + } + + if (!php_stream_truncate_supported(intern->u.file.stream)) { zend_throw_exception_ex(spl_ce_LogicException, 0, "Can't truncate file %s", ZSTR_VAL(intern->file_name)); RETURN_THROWS(); diff --git a/ext/spl/tests/gh17463.phpt b/ext/spl/tests/gh17463.phpt new file mode 100644 index 00000000000..41939c62f5b --- /dev/null +++ b/ext/spl/tests/gh17463.phpt @@ -0,0 +1,16 @@ +--TEST-- +GH-17463 segfault on SplFileObject::ftruncate() with negative value. +--CREDITS-- +YuanchengJiang +--FILE-- +ftruncate(-1); +} catch (\ValueError $e) { + echo $e->getMessage(); +} +?> +--EXPECT-- +SplFileObject::ftruncate(): Argument #1 ($size) must be greater than or equal to 0