From: Anatol Belski <ab@php.net>
Date: Sun, 11 Sep 2016 10:36:58 +0000 (+0200)
Subject: Revert "Revert "Merge branch 'PHP-5.6' into PHP-7.0""
X-Git-Tag: php-7.0.11~21
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d947d974d598a35f08a6a9057ffc3dffac72c6c2;p=php

Revert "Revert "Merge branch 'PHP-5.6' into PHP-7.0""

This reverts commit 62d5bfb5277dd84e1a185c567982f2196cd19437.
---

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 5c90b30559..e228ce6121 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1546,6 +1546,11 @@ PHP_NAMED_FUNCTION(php_if_ftruncate)
 		RETURN_FALSE;
 	}
 
+	if (size < 0) {
+		php_error_docref(NULL, E_WARNING, "Negative size is not supported");
+		RETURN_FALSE;
+	}
+
 	PHP_STREAM_TO_ZVAL(stream, fp);
 
 	if (!php_stream_truncate_supported(stream)) {
diff --git a/ext/standard/tests/file/bug71882.phpt b/ext/standard/tests/file/bug71882.phpt
new file mode 100644
index 0000000000..ae0137b599
--- /dev/null
+++ b/ext/standard/tests/file/bug71882.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #71882 (Negative ftruncate() on php://memory exhausts memory)
+--FILE--
+<?php
+$fd = fopen("php://memory", "w+");
+ftruncate($fd, -1);
+?>
+==DONE==
+--EXPECTF--
+Warning: ftruncate(): Negative size is not supported in %s%ebug71882.php on line %d
+==DONE==