diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-08-30 02:08:50 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-08-30 02:13:48 +0200 |
| commit | 65f0c163f929e48162efc3491fee918bb5c4c280 (patch) | |
| tree | 4643225e6dd362ce487c8f67b37c8e26617d114f | |
| parent | 4b45c0a9a7d48a69edba9e00270c49bbe17af4d1 (diff) | |
| parent | 207dab585aadd9f320976a0895734d7d9ca7b862 (diff) | |
| download | php-git-65f0c163f929e48162efc3491fee918bb5c4c280.tar.gz | |
Merge branch 'PHP-5.6' into PHP-7.0
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/file.c | 5 | ||||
| -rw-r--r-- | ext/standard/tests/file/bug71882.phpt | 11 |
3 files changed, 18 insertions, 0 deletions
@@ -80,6 +80,8 @@ PHP NEWS . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb) . Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign). (cmb) + . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory). + (cmb) - Streams: . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence) diff --git a/ext/standard/file.c b/ext/standard/file.c index 5c90b30559..e228ce6121 100644 --- a/ext/standard/file.c +++ b/ext/standard/file.c @@ -1546,6 +1546,11 @@ PHP_NAMED_FUNCTION(php_if_ftruncate) RETURN_FALSE; } + if (size < 0) { + php_error_docref(NULL, E_WARNING, "Negative size is not supported"); + RETURN_FALSE; + } + PHP_STREAM_TO_ZVAL(stream, fp); if (!php_stream_truncate_supported(stream)) { diff --git a/ext/standard/tests/file/bug71882.phpt b/ext/standard/tests/file/bug71882.phpt new file mode 100644 index 0000000000..ae0137b599 --- /dev/null +++ b/ext/standard/tests/file/bug71882.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #71882 (Negative ftruncate() on php://memory exhausts memory) +--FILE-- +<?php +$fd = fopen("php://memory", "w+"); +ftruncate($fd, -1); +?> +==DONE== +--EXPECTF-- +Warning: ftruncate(): Negative size is not supported in %s%ebug71882.php on line %d +==DONE== |