diff --git a/ext/curl/multi.c b/ext/curl/multi.c index e8c32301d2e4d..70cc7e0366410 100644 --- a/ext/curl/multi.c +++ b/ext/curl/multi.c @@ -187,7 +187,15 @@ PHP_FUNCTION(curl_multi_select) mh = Z_CURL_MULTI_P(z_mh); - error = curl_multi_wait(mh->multi, NULL, 0, (unsigned long) (timeout * 1000.0), &numfds); + if (!(timeout >= 0.0 && timeout <= ((double)INT_MAX / 1000.0))) { + php_error_docref(NULL, E_WARNING, "timeout must be between 0 and %d", (int)ceilf((double)INT_MAX / 1000)); +#ifdef CURLM_BAD_FUNCTION_ARGUMENT + SAVE_CURLM_ERROR(mh, CURLM_BAD_FUNCTION_ARGUMENT); +#endif + RETURN_LONG(-1); + } + + error = curl_multi_wait(mh->multi, NULL, 0, (int) (timeout * 1000.0), &numfds); if (CURLM_OK != error) { SAVE_CURLM_ERROR(mh, error); RETURN_LONG(-1); diff --git a/ext/curl/tests/gh15547.phpt b/ext/curl/tests/gh15547.phpt new file mode 100644 index 0000000000000..bbb1d5c5b0365 --- /dev/null +++ b/ext/curl/tests/gh15547.phpt @@ -0,0 +1,29 @@ +--TEST-- +GH-15547 - curl_multi_select overflow on timeout argument +--EXTENSIONS-- +curl +--FILE-- + +--EXPECTF-- +Warning: curl_multi_select(): timeout must be between 0 and %d in %s on line %d +int(-1) +%s + +Warning: curl_multi_select(): timeout must be between 0 and %d in %s on line %d +int(-1) +%s +int(0) +string(8) "No error"