From: Hannes Magnusson <bjori@php.net>
Date: Sun, 29 May 2011 12:29:19 +0000 (+0000)
Subject: Fixed bug #54946 (stream_get_contents infinite loop)
X-Git-Tag: php-5.3.7RC1~68
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3b030ec75f51ef16347f548853471f7baf48bb5c;p=php

Fixed bug #54946 (stream_get_contents infinite loop)
---

diff --git a/NEWS b/NEWS
index e74adc84cc..e0c676598b 100644
--- a/NEWS
+++ b/NEWS
@@ -151,6 +151,7 @@ PHP                                                                        NEWS
     (Felipe)
 
 - Streams:
+  . Fixed bug #54946 (stream_get_contents infinite loop). (Hannes)
   . Fixed bug #54623 (Segfault when when writing to a persistent socket after
     closing a copy of the socket). (Gustavo)
     
diff --git a/ext/standard/tests/streams/bug54946.phpt b/ext/standard/tests/streams/bug54946.phpt
new file mode 100644
index 0000000000..b3fa73df5c
--- /dev/null
+++ b/ext/standard/tests/streams/bug54946.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug#54946 stream_get_contents infinite loop
+--FILE--
+<?php
+$filename = tempnam(sys_get_temp_dir(), "phpbug");
+
+$stream = fopen($filename, "w"); // w or a
+$retval = stream_get_contents($stream, 1, 1);
+
+var_dump($retval);
+unlink($filename);
+
+
+
+$filename = tempnam(sys_get_temp_dir(), "phpbug2");
+
+$stream = fopen($filename, "a");
+$retval = stream_get_contents($stream, 1, 1);
+
+var_dump($retval);
+unlink($filename);
+
+
+
+$filename = tempnam(sys_get_temp_dir(), "phpbug3");
+
+$stream = fopen($filename, "a");
+fseek($stream, 1);
+$retval = stream_get_contents($stream, 1);
+
+var_dump($retval);
+unlink($filename);
+?>
+===DONE===
+--EXPECT--
+string(0) ""
+string(0) ""
+string(0) ""
+===DONE===
+
diff --git a/main/streams/streams.c b/main/streams/streams.c
index aafb652a08..5029f5cd02 100755
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1291,6 +1291,9 @@ PHPAPI size_t _php_stream_copy_to_mem(php_stream *src, char **buf, size_t maxlen
 		ptr = *buf = pemalloc_rel_orig(maxlen + 1, persistent);
 		while ((len < maxlen) && !php_stream_eof(src)) {
 			ret = php_stream_read(src, ptr, maxlen - len);
+			if (!ret) {
+				break;
+			}
 			len += ret;
 			ptr += ret;
 		}