Avoid overflow

laruence · laruence · commit c718fd16a1ce · 2017-11-13T11:18:56.000+08:00
diff --git a/ext/standard/file.c b/ext/standard/file.c
@@ -1772,7 +1772,7 @@ PHPAPI PHP_FUNCTION(fread)
 	/* needed because recv/read/gzread doesnt put a null at the end*/
 	Z_STRVAL_P(return_value)[Z_STRLEN_P(return_value)] = 0;
 
-	if (len > Z_STRLEN_P(return_value) * 2) {
+	if (Z_STRLEN_P(return_value) < len / 2) {
 		Z_STR_P(return_value) = zend_string_truncate(Z_STR_P(return_value), Z_STRLEN_P(return_value), 0);
 	}
 }

Original file line number	Diff line number	Diff line change
`@@ -1772,7 +1772,7 @@ PHPAPI PHP_FUNCTION(fread)`
`1772`	`1772`	`/* needed because recv/read/gzread doesnt put a null at the end*/`
`1773`	`1773`	`Z_STRVAL_P(return_value)[Z_STRLEN_P(return_value)] = 0;`
`1774`	`1774`
`1775`		`- if (len > Z_STRLEN_P(return_value) * 2) {`
	`1775`	`+ if (Z_STRLEN_P(return_value) < len / 2) {`
`1776`	`1776`	`Z_STR_P(return_value) = zend_string_truncate(Z_STR_P(return_value), Z_STRLEN_P(return_value), 0);`
`1777`	`1777`	`}`
`1778`	`1778`	`}`