[php-src] PR #23481: ext/ftp: validate $port range before narrowing to short in ftp_connect/ftp_ssl_connect

From: Date: Thu, 27 Aug 2026 12:13:11 +0000
Subject: [php-src] PR #23481: ext/ftp: validate $port range before narrowing to short in ftp_connect/ftp_ssl_connect
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38168@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23481 Author: lacatoire ftp_connect() and ftp_ssl_connect() accept $port as zend_long but cast it to C short at the ftp_open() call site without range-checking first. Values outside 0–65535 silently wrap: 65536 narrows to 0, which ftp_open() rewrites to 21, connecting to the FTP control port regardless of what the caller requested. The fix validates $port before the cast and throws a ValueError for out-of-range values, consistent with how other extensions handle integer narrowing. A test covering the boundary and the silent-wrap case is added.

« previous php.git-pulls (#38168) next »