Skip to content

Commit df8f676

Browse files
committed
Fix GH-16267 socket_strerror overflow on argument value.
only socket_strerror provides user-supplied value to sockets_strerror handler.
1 parent 2d05da2 commit df8f676

File tree

2 files changed

+28
-0
lines changed

2 files changed

+28
-0
lines changed

ext/sockets/sockets.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1211,6 +1211,11 @@ PHP_FUNCTION(socket_strerror)
12111211
RETURN_THROWS();
12121212
}
12131213

1214+
if (arg1 < INT_MIN || arg1 > INT_MAX) {
1215+
zend_argument_value_error(1, "must be between %d and %d", INT_MIN, INT_MAX);
1216+
RETURN_THROWS();
1217+
}
1218+
12141219
RETURN_STRING(sockets_strerror(arg1));
12151220
}
12161221
/* }}} */

ext/sockets/tests/gh16267.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
GH-16267 - overflow on socket_strerror argument
3+
--EXTENSIONS--
4+
sockets
5+
--FILE--
6+
<?php
7+
try {
8+
socket_strerror(PHP_INT_MIN);
9+
} catch (\ValueError $e) {
10+
echo $e->getMessage() . PHP_EOL;
11+
}
12+
try {
13+
socket_strerror(PHP_INT_MAX);
14+
} catch (\ValueError $e) {
15+
echo $e->getMessage() . PHP_EOL;
16+
}
17+
18+
var_dump(socket_strerror(-1));
19+
?>
20+
--EXPECTF--
21+
socket_strerror(): Argument #1 ($error_code) must be between %s and %s
22+
socket_strerror(): Argument #1 ($error_code) must be between %s and %s
23+
string(16) "Unknown error -1"

0 commit comments

Comments
 (0)