From: Ilia Alshanetsky <iliaa@php.net>
Date: Fri, 2 Jan 2004 00:58:15 +0000 (+0000)
Subject: MFH: Fixed bug #26752 (Silent unterminated loop when length parameter for
X-Git-Tag: php-4.3.5RC1~17
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1fc017d8a3ed640587cafc3174dfca1c882ed79f;p=php

MFH: Fixed bug #26752 (Silent unterminated loop when length parameter for
fgets(), fread() and fgetss() is 0).
---

diff --git a/NEWS b/NEWS
index 98a86db114..dff8f19270 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ PHP 4                                                                      NEWS
 - Added a warning when creating temp stream fails with ftp_(n)list(). (Sara)
 - Fixed header handler in NSAPI SAPI module (header->replace was ignored,
   send_default_content_type now sends value from php.ini). (Uwe Schindler)
+- Fixed bug #26752 (Silent unterminated loop when length parameter for
+  fgets(), fread() and fgetss() is 0). (Ilia)
 - Fixed bug #26751 (PHP can't find the MySQL socket on a case sensitive file
   system). (Derick)
 - Fixed Bug #26703 (Certain characters inside strings incorrectly treated as
diff --git a/ext/standard/file.c b/ext/standard/file.c
index ec53d34e77..1d5ec1ff13 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1374,8 +1374,8 @@ PHPAPI PHP_FUNCTION(fgets)
 		convert_to_long_ex(arg2);
 		len = Z_LVAL_PP(arg2);
 
-		if (len < 0) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+		if (len <= 0) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
 			RETURN_FALSE;
 		}
 
@@ -1471,8 +1471,8 @@ PHPAPI PHP_FUNCTION(fgetss)
 
 	convert_to_long_ex(bytes);
 	len = Z_LVAL_PP(bytes);
-	if (len < 0) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+	if (len <= 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
 		RETURN_FALSE;
 	}
 
@@ -2136,8 +2136,8 @@ PHPAPI PHP_FUNCTION(fread)
 
 	convert_to_long_ex(arg2);
 	len = Z_LVAL_PP(arg2);
-	if (len < 0) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter may not be negative");
+	if (len <= 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater then 0.");
 		RETURN_FALSE;
 	}