Fixed crash inside stream_get_line() when length parameter equals 0.

diff --git a/NEWS b/NEWS
index 1acd0ffa1b09d40ffedf3e4a82ff768d68169c04..f754f3a9ddece7b4113b60abbca1699911af80d1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
 - Implemented feature request #33452 (Year belonging to ISO week). (Derick)
 - Fixed memory corruption in pg_copy_from() in case the as_null parameter was
   passed. (Derick)
+- Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia)
 - Fixed bug #33562 (date("") crashes). (Derick)
 - Fixed bug #33536 (strtotime() defaults to now even on non time string).
   (Derick)

diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c
index 5aa7f410da63306b4e3d13188a754234a18913d5..c594b0ecce46ca964d7acfd7b6722802637b460c 100644 (file)
--- a/ext/standard/streamsfuncs.c
+++ b/ext/standard/streamsfuncs.c
@@ -1176,6 +1176,9 @@ PHP_FUNCTION(stream_get_line)
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "The maximum allowed length must be greater then or equal to zero.");
                RETURN_FALSE;
        }
+       if (!max_length) {
+               max_length = PHP_SOCK_CHUNK_SIZE;
+       }
 
        php_stream_from_zval(stream, &zstream);
 

diff --git a/ext/standard/tests/file/stream_get_line.phpt b/ext/standard/tests/file/stream_get_line.phpt
new file mode 100644 (file)
index 0000000..2c11f00
--- /dev/null
+++ b/ext/standard/tests/file/stream_get_line.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Crash inside stream_get_line(), when length=0
+--FILE--
+<?php
+$path = dirname(__FILE__) . '/test.html';
+
+file_put_contents($path, "foo<br>bar<br>foo");
+$fp = fopen($path, "r");
+while ($fp && !feof($fp)) {
+       echo stream_get_line($fp, 0, "<br>")."\n";
+}
+fclose($fp);
+@unlink($path);
+?>
+--EXPECT--
+foo
+bar
+foo