Skip to content

Commit e40cde0

Browse files
committed
Fix socket_recvfrom overflow on buffer size.
when passing PHP_INT_MAX for the $length param we get this (with ubsan) `ext/sockets/sockets.c:1409:36: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long int'`
1 parent e8ef81a commit e40cde0

File tree

2 files changed

+16
-1
lines changed

2 files changed

+16
-1
lines changed

ext/sockets/sockets.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1402,7 +1402,8 @@ PHP_FUNCTION(socket_recvfrom)
14021402

14031403
/* overflow check */
14041404
/* Shouldthrow ? */
1405-
if ((arg3 + 2) < 3) {
1405+
1406+
if (arg3 <= 0 || arg3 > ZEND_LONG_MAX - 1) {
14061407
RETURN_FALSE;
14071408
}
14081409

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
socket_recvfrom overflow on length argument
3+
--EXTENSIONS--
4+
sockets
5+
--FILE--
6+
<?php
7+
$s = socket_create(AF_UNIX, SOCK_DGRAM, 0);
8+
$buf = $end = "";
9+
var_dump(socket_recvfrom($s, $buf, PHP_INT_MAX, 0, $end));
10+
var_dump(socket_recvfrom($s, $buf, -1, 0, $end));
11+
?>
12+
--EXPECT--
13+
bool(false)
14+
bool(false)

0 commit comments

Comments
 (0)