Fix GH-15937: stream timeout option overflow.

close GH-15942

Author: devnexen

NEWS

@@ -43,6 +43,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug GH-15613 (overflow on unpack call hex string repeater).
     (David Carlier)
+  . Fixed bug GH-15937 (overflow on stream timeout option value).
+    (David Carlier)
 
 - Streams:
   . Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).

ext/standard/tests/streams/gh15937.phpt

@@ -0,0 +1,16 @@
+--TEST--
+GH-15937 (stream overflow on timeout setting)
+--SKIPIF--
+<?php if (getenv("SKIP_ONLINE_TESTS")) die("skip online test"); ?>
+--FILE--
+<?php
+$config = [
+    'http' => [
+        'timeout' => PHP_INT_MAX,
+    ],
+];
+$ctx = stream_context_create($config);
+var_dump(fopen("http://www.example.com", "r", false, $ctx));
+?>
+--EXPECTF--
+resource(%d) of type (stream)

main/php_network.h

@@ -162,7 +162,7 @@ PHPAPI int php_poll2(php_pollfd *ufds, unsigned int nfds, int timeout);
 /* timeval-to-timeout (for poll(2)) */
 static inline int php_tvtoto(struct timeval *timeouttv)
 {
-	if (timeouttv) {
+	if (timeouttv && timeouttv->tv_sec >= 0 && timeouttv->tv_sec <= ((INT_MAX - 1000) / 1000)) {
 		return (timeouttv->tv_sec * 1000) + (timeouttv->tv_usec / 1000);
 	}
 	return -1;