From 727529214b0cbb0fe41100942a744d6571e48cd5 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 17 Sep 2024 19:43:42 +0100 Subject: [PATCH 1/3] Fix GH-15937: stream timeout option overflow. --- ext/standard/tests/streams/gh15937.phpt | 14 ++++++++++++++ main/php_network.h | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 ext/standard/tests/streams/gh15937.phpt diff --git a/ext/standard/tests/streams/gh15937.phpt b/ext/standard/tests/streams/gh15937.phpt new file mode 100644 index 0000000000000..7293cce247cc4 --- /dev/null +++ b/ext/standard/tests/streams/gh15937.phpt @@ -0,0 +1,14 @@ +--TEST-- +GH-15937 (stream overflow on timeout setting) +--FILE-- + [ + 'timeout' => PHP_INT_MAX, + ], +]; +$ctx = stream_context_create($config); +var_dump(fopen("http://example.com", "r", false, $ctx)); +?> +--EXPECTF-- +resource(%d) of type (stream) diff --git a/main/php_network.h b/main/php_network.h index a3b7ba7ab3180..a109d67e56bb6 100644 --- a/main/php_network.h +++ b/main/php_network.h @@ -162,7 +162,7 @@ PHPAPI int php_poll2(php_pollfd *ufds, unsigned int nfds, int timeout); /* timeval-to-timeout (for poll(2)) */ static inline int php_tvtoto(struct timeval *timeouttv) { - if (timeouttv) { + if (timeouttv && timeouttv->tv_sec >= 0 && timeouttv->tv_sec <= (INT_MAX / 1000)) { return (timeouttv->tv_sec * 1000) + (timeouttv->tv_usec / 1000); } return -1; From 8de28ca987370425fceaeecd88be183d481b691e Mon Sep 17 00:00:00 2001 From: David Carlier Date: Wed, 18 Sep 2024 05:08:04 +0100 Subject: [PATCH 2/3] decreasing upper valid limit --- ext/standard/tests/streams/gh15937.phpt | 2 +- main/php_network.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/standard/tests/streams/gh15937.phpt b/ext/standard/tests/streams/gh15937.phpt index 7293cce247cc4..2737fd3de0906 100644 --- a/ext/standard/tests/streams/gh15937.phpt +++ b/ext/standard/tests/streams/gh15937.phpt @@ -8,7 +8,7 @@ $config = [ ], ]; $ctx = stream_context_create($config); -var_dump(fopen("http://example.com", "r", false, $ctx)); +var_dump(fopen("http://www.example.com", "r", false, $ctx)); ?> --EXPECTF-- resource(%d) of type (stream) diff --git a/main/php_network.h b/main/php_network.h index a109d67e56bb6..fda61b87cb4c9 100644 --- a/main/php_network.h +++ b/main/php_network.h @@ -162,7 +162,7 @@ PHPAPI int php_poll2(php_pollfd *ufds, unsigned int nfds, int timeout); /* timeval-to-timeout (for poll(2)) */ static inline int php_tvtoto(struct timeval *timeouttv) { - if (timeouttv && timeouttv->tv_sec >= 0 && timeouttv->tv_sec <= (INT_MAX / 1000)) { + if (timeouttv && timeouttv->tv_sec >= 0 && timeouttv->tv_sec <= ((INT_MAX - 1000) / 1000)) { return (timeouttv->tv_sec * 1000) + (timeouttv->tv_usec / 1000); } return -1; From 901a7f225fcb6d41a7b5f4bd52c68683cd61eb28 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Mon, 30 Sep 2024 12:55:36 +0100 Subject: [PATCH 3/3] update test --- ext/standard/tests/streams/gh15937.phpt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ext/standard/tests/streams/gh15937.phpt b/ext/standard/tests/streams/gh15937.phpt index 2737fd3de0906..db0564342b13b 100644 --- a/ext/standard/tests/streams/gh15937.phpt +++ b/ext/standard/tests/streams/gh15937.phpt @@ -1,10 +1,12 @@ --TEST-- GH-15937 (stream overflow on timeout setting) +--SKIPIF-- + --FILE-- [ - 'timeout' => PHP_INT_MAX, + 'timeout' => PHP_INT_MAX, ], ]; $ctx = stream_context_create($config);