MFH: Fixed possible crash inside dio_read().

diff --git a/ext/dio/dio.c b/ext/dio/dio.c
index 38f858706ab64f6dc631702574b78c74e0d9fe48..90e07b6a779fee59db7d1ce9ba1aa0c3a9029955 100644 (file)
--- a/ext/dio/dio.c
+++ b/ext/dio/dio.c
@@ -199,6 +199,11 @@ PHP_FUNCTION(dio_read)
        }
        ZEND_FETCH_RESOURCE(f, php_fd_t *, &r_fd, -1, le_fd_name, le_fd);
 
+       if (bytes <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater than 0.");
+               RETURN_FALSE;
+       }
+
        data = emalloc(bytes + 1);
        res = read(f->fd, data, bytes);
        if (res <= 0) {