From c933634253b4e31ade3c76a4c2cd7e6b7ec358e2 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Tue, 5 Jul 2005 19:24:07 +0000 Subject: [PATCH] Fixed crash inside stream_get_line() when length parameter equals 0. --- NEWS | 1 + ext/standard/streamsfuncs.c | 3 +++ ext/standard/tests/file/stream_get_line.phpt | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+) create mode 100644 ext/standard/tests/file/stream_get_line.phpt diff --git a/NEWS b/NEWS index 1acd0ffa1b..f754f3a9dd 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,7 @@ PHP NEWS - Implemented feature request #33452 (Year belonging to ISO week). (Derick) - Fixed memory corruption in pg_copy_from() in case the as_null parameter was passed. (Derick) +- Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia) - Fixed bug #33562 (date("") crashes). (Derick) - Fixed bug #33536 (strtotime() defaults to now even on non time string). (Derick) diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index 5aa7f410da..c594b0ecce 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -1176,6 +1176,9 @@ PHP_FUNCTION(stream_get_line) php_error_docref(NULL TSRMLS_CC, E_WARNING, "The maximum allowed length must be greater then or equal to zero."); RETURN_FALSE; } + if (!max_length) { + max_length = PHP_SOCK_CHUNK_SIZE; + } php_stream_from_zval(stream, &zstream); diff --git a/ext/standard/tests/file/stream_get_line.phpt b/ext/standard/tests/file/stream_get_line.phpt new file mode 100644 index 0000000000..2c11f00eed --- /dev/null +++ b/ext/standard/tests/file/stream_get_line.phpt @@ -0,0 +1,18 @@ +--TEST-- +Crash inside stream_get_line(), when length=0 +--FILE-- +bar
foo"); +$fp = fopen($path, "r"); +while ($fp && !feof($fp)) { + echo stream_get_line($fp, 0, "
")."\n"; +} +fclose($fp); +@unlink($path); +?> +--EXPECT-- +foo +bar +foo -- 2.50.1