Revert "Revert "Merge branch 'PHP-5.6' into PHP-7.0""

This reverts commit 62d5bfb5277dd84e1a185c567982f2196cd19437.

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 5c90b305591a078e7e90eeca7512849bf71f64de..e228ce6121db2971bf5cc21a219d18f66e75add6 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1546,6 +1546,11 @@ PHP_NAMED_FUNCTION(php_if_ftruncate)
                RETURN_FALSE;
        }
 
+       if (size < 0) {
+               php_error_docref(NULL, E_WARNING, "Negative size is not supported");
+               RETURN_FALSE;
+       }
+
        PHP_STREAM_TO_ZVAL(stream, fp);
 
        if (!php_stream_truncate_supported(stream)) {

diff --git a/ext/standard/tests/file/bug71882.phpt b/ext/standard/tests/file/bug71882.phpt
new file mode 100644 (file)
index 0000000..ae0137b
--- /dev/null
+++ b/ext/standard/tests/file/bug71882.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #71882 (Negative ftruncate() on php://memory exhausts memory)
+--FILE--
+<?php
+$fd = fopen("php://memory", "w+");
+ftruncate($fd, -1);
+?>
+==DONE==
+--EXPECTF--
+Warning: ftruncate(): Negative size is not supported in %s%ebug71882.php on line %d
+==DONE==