Added another bug fix to detect for negative values being passed into the

fd_*() functions, as passing negative values would cause PHP to segfault.

diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c
index 759f2c7b0e185bf6a3035ce94d3fb11b0ee3ebf1..eb48e91f6e03a5058eafd05aadfafffc3ee10186 100644 (file)
--- a/ext/sockets/sockets.c
+++ b/ext/sockets/sockets.c
@@ -271,6 +271,11 @@ PHP_FUNCTION(fd_set)
 
        ZEND_FETCH_RESOURCE(the_set, fd_set *, set, -1, "File descriptor set", SOCKETSG(le_destroy));
 
+       if (Z_LVAL_PP(fd) < 0) {
+               php_error(E_WARNING, "Can't set negative fd falues in a set");
+               RETURN_FALSE;
+       }
+
        FD_SET(Z_LVAL_PP(fd), the_set);
 
        RETURN_TRUE;
@@ -293,6 +298,11 @@ PHP_FUNCTION(fd_clear)
 
        ZEND_FETCH_RESOURCE(the_set, fd_set *, set, -1, "File descriptor set", SOCKETSG(le_destroy));
 
+       if (Z_LVAL_PP(fd) < 0) {
+               php_error(E_WARNING, "Can't clear negative fd values in a set");
+               RETURN_FALSE;
+       }
+
        FD_CLR(Z_LVAL_PP(fd), the_set);
 
        RETURN_TRUE;
@@ -315,6 +325,11 @@ PHP_FUNCTION(fd_isset)
 
        ZEND_FETCH_RESOURCE(the_set, fd_set *, set, -1, "File descriptor set", SOCKETSG(le_destroy));
 
+       if (Z_LVAL_PP(fd) < 0) {
+               php_error(E_WARNING, "Can't check for negative fd values in a set");
+               RETURN_FALSE;
+       }
+
        if (FD_ISSET(Z_LVAL_PP(fd), the_set)) {
                RETURN_TRUE;
        }