Fixed possible crash in stream_socket_recvfrom() when length parameter has

a negative value.

diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c
index 1e889f0b8a30054e4953be46e547791c21fee942..db4d26134543f70c8481865fe56a47638f4145dc 100644 (file)
--- a/ext/standard/streamsfuncs.c
+++ b/ext/standard/streamsfuncs.c
@@ -317,6 +317,11 @@ PHP_FUNCTION(stream_socket_recvfrom)
                ZVAL_NULL(zremote);
                Z_STRLEN_P(zremote) = 0;
        }
+
+       if (to_read <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater than 0.");
+               RETURN_FALSE;
+       }
        
        read_buf = emalloc(to_read + 1);