Fix GH-10548: copy() fails on cifs mounts because of incorrect length (cfr_max) specified in streams.c:1584 copy_file_range()

On some filesystems, the copy operation fails if we specify a size
larger than the file size. We use a stat call to clamp the size to copy
to the actual filesize. This stat call shouldn't impact performance
notably because stat calls can be cached. In some cases (like for /proc
files), the returned size is 0, so we should avoid problems by not using
copy_file_range in those cases (copy_file_range wouldn't work anyway on
this particular example because the syscall is not supported for /proc).

Author: nielsdos

main/streams/streams.c

@@ -1567,14 +1567,21 @@ PHPAPI zend_result _php_stream_copy_to_stream_ex(php_stream *src, php_stream *de
 		/* get dest open flags to check if the stream is open in append mode */
 		php_stream_parse_fopen_modes(dest->mode, &dest_open_flags);
 
+		/* Some filesystems will cause failures if the max length is greater than the file length.
+		 * We therefore use a stat call to get the actual file size. Since stat calls are cached
+		 * this shouldn't have much impact. */
+		php_stream_statbuf statbuf;
+
 		/* copy_file_range does not work with O_APPEND */
 		if (php_stream_cast(src, PHP_STREAM_AS_FD, (void*)&src_fd, 0) == SUCCESS &&
 				php_stream_cast(dest, PHP_STREAM_AS_FD, (void*)&dest_fd, 0) == SUCCESS &&
 				php_stream_parse_fopen_modes(dest->mode, &dest_open_flags) == SUCCESS &&
-				!(dest_open_flags & O_APPEND)) {
-
-			/* clamp to INT_MAX to avoid EOVERFLOW */
-			const size_t cfr_max = MIN(maxlen, (size_t)SSIZE_MAX);
+				!(dest_open_flags & O_APPEND) &&
+				php_stream_stat(src, &statbuf) == SUCCESS &&
+				/* Some files (such as /proc files) report a size of zero, avoid problems */
+				statbuf.sb.st_size > 0) {
+			/* clamp to INT_MAX to avoid EOVERFLOW, and to the filesize to avoid failure on some filesystems */
+			const size_t cfr_max = MIN(MIN(maxlen, (size_t)SSIZE_MAX), statbuf.sb.st_size);
 
 			/* copy_file_range() is a Linux-specific system call which allows efficient copying
 			 * between two file descriptors, eliminating the need to transfer data from the kernel