From c30bddc18fe91d80947091bf088871760dcb91cb Mon Sep 17 00:00:00 2001 From: David Carlier Date: Wed, 21 May 2025 19:26:15 +0100 Subject: [PATCH] Fix GH-18617: socket_import_file_descriptor return check. to_zval_read_fd_array() helper when retrieving the socket protocol did not check it. close GH-18617 --- NEWS | 4 ++++ ext/sockets/conversions.c | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 6ae1dfce797..d712f80818a 100644 --- a/NEWS +++ b/NEWS @@ -47,6 +47,10 @@ PHP NEWS - PDO_OCI: . Fixed bug GH-18494 (PDO OCI segfault in statement GC). (nielsdos) +- Sockets: + - Fixed bug GH-18617 (socket_import_file_descriptor return value + unchecked). (David Carlier) + - SPL: . Fixed bug GH-18421 (Integer overflow with large numbers in LimitIterator). (nielsdos) diff --git a/ext/sockets/conversions.c b/ext/sockets/conversions.c index 4059758f447..d03ef8ef68d 100644 --- a/ext/sockets/conversions.c +++ b/ext/sockets/conversions.c @@ -1457,7 +1457,11 @@ void to_zval_read_fd_array(const char *data, zval *zv, res_context *ctx) object_init_ex(&elem, socket_ce); php_socket *sock = Z_SOCKET_P(&elem); - socket_import_file_descriptor(fd, sock); + if (!socket_import_file_descriptor(fd, sock)) { + do_to_zval_err(ctx, "error getting protocol descriptor %d: getsockopt() call failed with errno %d", fd, errno); + zval_ptr_dtor(&elem); + return; + } } else { php_stream *stream = php_stream_fopen_from_fd(fd, "rw", NULL); php_stream_to_zval(stream, &elem);