MFH: Fixed bug #31024 (Crash in fgetcsv() with negative length).

diff --git a/NEWS b/NEWS
index 9a5d8d23003b9a6696751ed2541cff8684e34a1b..bbfaa967cbd402bf9c7506351437854d00d5d630 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,9 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? Dec 2004, Version 4.3.10
+- Fixed bug #31024 (Crash in fgetcsv() with negative length). (Ilia)
+- Fixed bug #31019 (Logic error mssql library checking). (Frank)
+
 07 Dec 2004, Version 4.3.10RC2
 - Fixed bug #30995 (snmp extension does not build with net-snmp 5.2). (Ilia)
 - Fixed bug #30990 (allow popen() on *NIX to accept 'b' flag). (Ilia)

diff --git a/ext/standard/file.c b/ext/standard/file.c
index fdbe22568c1749b759be2f04c00254a56e21bf9e..b0bae7c1d115502b092c8c68cf9819d63bcb88cc 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -2335,7 +2335,7 @@ PHP_FUNCTION(fgetcsv)
 
        convert_to_long_ex(bytes);
        len = Z_LVAL_PP(bytes);
-       if (len < 0) {
+       if (Z_LVAL_PP(bytes) < 0) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
                RETURN_FALSE;
        }