MFH: Fixed possible crash in stream_socket_recvfrom() when length

parameter has a negative value.

diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c
index b73fabe8d8dc60852399d07d4f7bb2f5e225e2d0..af1998cbdaf8d3b039f9192fbfafcf9c98177994 100644 (file)
--- a/ext/standard/streamsfuncs.c
+++ b/ext/standard/streamsfuncs.c
@@ -317,6 +317,11 @@ PHP_FUNCTION(stream_socket_recvfrom)
                ZVAL_NULL(zremote);
                Z_STRLEN_P(zremote) = 0;
        }
+
+       if (to_read <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater than 0.");
+               RETURN_FALSE;
+       }
        
        read_buf = emalloc(to_read + 1);