Skip to content

Commit 015fc48

Browse files
committed
Fix fseek undefined behavior
1 parent 40c76b2 commit 015fc48

File tree

2 files changed

+11
-2
lines changed

2 files changed

+11
-2
lines changed

main/streams/memory.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,11 @@ static int php_stream_memory_seek(php_stream *stream, zend_off_t offset, int whe
125125
php_stream_memory_data *ms = (php_stream_memory_data*)stream->abstract;
126126
assert(ms != NULL);
127127

128+
if (offset == ZEND_LONG_MIN) {
129+
zend_argument_value_error(2, "must be greater than " ZEND_LONG_FMT, ZEND_LONG_MIN);
130+
return FAILURE;
131+
}
132+
128133
switch(whence) {
129134
case SEEK_CUR:
130135
if (offset < 0) {
@@ -165,7 +170,7 @@ static int php_stream_memory_seek(php_stream *stream, zend_off_t offset, int whe
165170
stream->eof = 0;
166171
stream->fatal_error = 0;
167172
return 0;
168-
} else if (ZSTR_LEN(ms->data) < -(size_t)offset) {
173+
} else if (ZSTR_LEN(ms->data) < (size_t)(-offset)) {
169174
ms->fpos = 0;
170175
*newoffs = -1;
171176
return -1;

tests/basic/bug20964.phpt

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,8 @@ $result = fseek($stream, PHP_INT_MIN, SEEK_END);
88
var_dump($result);
99
?>
1010
--EXPECTF--
11-
int(-1)
11+
Fatal error: Uncaught ValueError: fseek(): Argument #2 ($offset) must be greater than -%d in %s:%d
12+
Stack trace:
13+
#0 %s(%d): fseek(Resource id #%d, -%d, %d)
14+
#1 {main}
15+
thrown in %s on line %d

0 commit comments

Comments
 (0)