Fixed bug #72505 (readfile() mangles files larger than 2G)

diff --git a/NEWS b/NEWS
index 68eea45892c983df5d70c2fa829b126a58f8e161..816a20f451cf8a83a5525d40f14859243fbb197e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
   . Fixed bug #72463 (mail fails with invalid argument). (Anatol)
 
 - Standard:
+  . Fixed bug #72505 (readfile() mangles files larger than 2G). (Cschneid)
   . Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
     (Laruence)
 

diff --git a/main/streams/streams.c b/main/streams/streams.c
index d64d5caa6a546de42b19881c1c0ea0eeda2bf038..e21d21a80706b550a6f8f8c8f403ce4778202392 100644 (file)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1396,7 +1396,7 @@ PHPAPI size_t _php_stream_passthru(php_stream * stream STREAMS_DC)
                if (p) {
                        do {
                                /* output functions return int, so pass in int max */
-                               if (0 < (b = PHPWRITE(p, MIN(mapped - bcount, INT_MAX)))) {
+                               if (0 < (b = PHPWRITE(p + bcount, MIN(mapped - bcount, INT_MAX)))) {
                                        bcount += b;
                                }
                        } while (b > 0 && mapped > bcount);