MFH: Fixed bug #25316 (Possible infinite loop inside _php_stream_write()).

diff --git a/NEWS b/NEWS
index a67ddc765e74d531dcbefc7cd278246b9870ddbb..a0744e6f39c25f359b2abbd21504bd131d9837fe 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,7 @@ PHP 4                                                                      NEWS
 - Fixed bug #25348 ("make install" fails with --enable-short-tags). (Jani)
 - Fixed bug #25343 (is_dir() gives warning on FreeBSD). (Jani)
 - Fixed bug #25333 (Possible body corruption & crash in win32 mail()). (Ilia)
+- Fixed bug #25316 (Possible infinite loop inside _php_stream_write()). (Ilia)
 - Fixed bug #25314 (FTP_ASCII mode behaving like binary from Win->Unix). (Sara)
 - Fixed bug #25308 (php -m crashes when zend extensions are loaded). (Stas)
 - Fixed bug #25307 (Crash with WDDX serializer). (Sascha, Jani)

diff --git a/main/streams.c b/main/streams.c
index df4b18a46cc9a2c1f5cf6d9bf156883e948b4368..5d81315642db69f266699e1db6891ae166bf9da1 100755 (executable)
--- a/main/streams.c
+++ b/main/streams.c
@@ -908,7 +908,8 @@ PHPAPI size_t _php_stream_write(php_stream *stream, const char *buf, size_t coun
                } else {
                        justwrote = stream->ops->write(stream, buf, towrite TSRMLS_CC);
                }
-               if (justwrote > 0) {
+               /* convert justwrote to an integer, since normally it is unsigned */
+               if ((int)justwrote > 0) {
                        buf += justwrote;
                        count -= justwrote;
                        didwrite += justwrote;