Patch for segfaults in ext/standard/file.c

In fgets(), fread(), fgetcsv(), and fgetss(), the length parameter isn't checked before the memory is allocated; at least on my home Linux box, this makes PHP segfault when any of these functions is called with a negative length parameter. Here's a short patch; if anybody can think of a reason for me not to commit this, fire away. Index: file.c =================================================================== RCS file: /repository/php4/ext/standard/file.c,v retrieving revision 1.107 diff -u -r1.107 file.c --- file.c 2000/08/20 13:24:14 1.107 +++ file.c 2000/08/21 01:44:54 @@ -969,6 +969,10 @@ convert_to_long_ex(arg2); len = (*arg2)->value.lval; + if (len < 0) { + php_error(E_WARNING, "length parameter to fgets() may not be negative"); + RETURN_FALSE; + } if (type == le_socket) { issock=1; @@ -1078,6 +1082,10 @@ convert_to_long_ex(bytes); len = (*bytes)->value.lval; + if (len < 0) { + php_error(E_WARNING, "length parameter to fgetss() may not be negative"); + RETURN_FALSE; + } buf = emalloc(sizeof(char) * (len + 1)); /*needed because recv doesnt set null char at end*/ @@ -1798,6 +1806,10 @@ convert_to_long_ex(arg2); len = (*arg2)->value.lval; + if (len < 0) { + php_error(E_WARNING, "length parameter to fread() may not be negative"); + RETURN_FALSE; + } return_value->value.str.val = emalloc(sizeof(char) * (len + 1)); /* needed because recv doesnt put a null at the end*/ @@ -1867,6 +1879,10 @@ convert_to_long_ex(bytes); len = (*bytes)->value.lval; + if (len < 0) { + php_error(E_WARNING, "length parameter to fgetcsv() may not be negative"); + RETURN_FALSE; + } buf = emalloc(sizeof(char) * (len + 1)); /*needed because recv doesnt set null char at end*/ -- +----------------------------------------------------------------+ |Torben Wilson <torben@php.net> Netmill iTech| |http://www.coastnet.com/~torben http://www.netmill.fi| |Ph: 1 250 383-9735 torben@netmill.fi| +----------------------------------------------------------------+