Fixed bug #26752 (Silent unterminated loop when length parameter for

fgets(), fread() and fgetss() is 0).

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 27c2455851916f764413ded57c154aad05dd748c..582023c30a8a6d89cb996a13fff2632636bc4c48 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -919,8 +919,8 @@ PHPAPI PHP_FUNCTION(fgets)
                convert_to_long_ex(arg2);
                len = Z_LVAL_PP(arg2);
 
-               if (len < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+               if (len <= 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
                        RETURN_FALSE;
                }
 
@@ -1026,8 +1026,8 @@ PHPAPI PHP_FUNCTION(fgetss)
 
        if (bytes != NULL) {
                convert_to_long_ex(bytes);
-               if (Z_LVAL_PP(bytes) < 0) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+               if (Z_LVAL_PP(bytes) <= 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
                        RETURN_FALSE;
                }
 
@@ -1640,8 +1640,8 @@ PHPAPI PHP_FUNCTION(fread)
 
        convert_to_long_ex(arg2);
        len = Z_LVAL_PP(arg2);
-       if (len < 0) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+       if (len <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
                RETURN_FALSE;
        }