From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 5 Jul 2005 19:24:07 +0000 (+0000)
Subject: Fixed crash inside stream_get_line() when length parameter equals 0.
X-Git-Tag: php-5.1.0b3~176
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c933634253b4e31ade3c76a4c2cd7e6b7ec358e2;p=php

Fixed crash inside stream_get_line() when length parameter equals 0.
---

diff --git a/NEWS b/NEWS
index 1acd0ffa1b..f754f3a9dd 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
 - Implemented feature request #33452 (Year belonging to ISO week). (Derick)
 - Fixed memory corruption in pg_copy_from() in case the as_null parameter was
   passed. (Derick)
+- Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia)
 - Fixed bug #33562 (date("") crashes). (Derick)
 - Fixed bug #33536 (strtotime() defaults to now even on non time string).
   (Derick)
diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c
index 5aa7f410da..c594b0ecce 100644
--- a/ext/standard/streamsfuncs.c
+++ b/ext/standard/streamsfuncs.c
@@ -1176,6 +1176,9 @@ PHP_FUNCTION(stream_get_line)
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The maximum allowed length must be greater then or equal to zero.");
 		RETURN_FALSE;
 	}
+	if (!max_length) {
+		max_length = PHP_SOCK_CHUNK_SIZE;
+	}
 
 	php_stream_from_zval(stream, &zstream);
 
diff --git a/ext/standard/tests/file/stream_get_line.phpt b/ext/standard/tests/file/stream_get_line.phpt
new file mode 100644
index 0000000000..2c11f00eed
--- /dev/null
+++ b/ext/standard/tests/file/stream_get_line.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Crash inside stream_get_line(), when length=0
+--FILE--
+<?php
+$path = dirname(__FILE__) . '/test.html';
+
+file_put_contents($path, "foo<br>bar<br>foo");
+$fp = fopen($path, "r");
+while ($fp && !feof($fp)) {
+	echo stream_get_line($fp, 0, "<br>")."\n";
+}
+fclose($fp);
+@unlink($path);
+?>
+--EXPECT--
+foo
+bar
+foo