MFH: Fixed bug #26752 (Silent unterminated loop when length parameter for

fgets(), fread() and fgetss() is 0).

diff --git a/NEWS b/NEWS
index 98a86db114c7377e0569da549565d75a460e8613..dff8f192707d4c0e359177105aff31655edb4860 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ PHP 4                                                                      NEWS
 - Added a warning when creating temp stream fails with ftp_(n)list(). (Sara)
 - Fixed header handler in NSAPI SAPI module (header->replace was ignored,
   send_default_content_type now sends value from php.ini). (Uwe Schindler)
+- Fixed bug #26752 (Silent unterminated loop when length parameter for
+  fgets(), fread() and fgetss() is 0). (Ilia)
 - Fixed bug #26751 (PHP can't find the MySQL socket on a case sensitive file
   system). (Derick)
 - Fixed Bug #26703 (Certain characters inside strings incorrectly treated as

diff --git a/ext/standard/file.c b/ext/standard/file.c
index ec53d34e774fc1f43989e04c2b620a87f2eae559..1d5ec1ff13a9c99dd192c60431bc2419294f98ff 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1374,8 +1374,8 @@ PHPAPI PHP_FUNCTION(fgets)
                convert_to_long_ex(arg2);
                len = Z_LVAL_PP(arg2);
 
-               if (len < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+               if (len <= 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
                        RETURN_FALSE;
                }
 
@@ -1471,8 +1471,8 @@ PHPAPI PHP_FUNCTION(fgetss)
 
        convert_to_long_ex(bytes);
        len = Z_LVAL_PP(bytes);
-       if (len < 0) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+       if (len <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
                RETURN_FALSE;
        }
 
@@ -2136,8 +2136,8 @@ PHPAPI PHP_FUNCTION(fread)
 
        convert_to_long_ex(arg2);
        len = Z_LVAL_PP(arg2);
-       if (len < 0) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+       if (len <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
                RETURN_FALSE;
        }