diff --git a/ext/standard/tests/streams/gh15980.phpt b/ext/standard/tests/streams/gh15980.phpt new file mode 100644 index 0000000000000..7a9d8364a90ae --- /dev/null +++ b/ext/standard/tests/streams/gh15980.phpt @@ -0,0 +1,12 @@ +--TEST-- +GH-15980 (Signed integer overflow in main/streams/streams.c) +--FILE-- + 1); +?> +--EXPECT-- +bool(true) diff --git a/main/streams/streams.c b/main/streams/streams.c index e22d9e51d594a..4c66d8aadc39b 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -1354,8 +1354,13 @@ PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence) switch(whence) { case SEEK_CUR: - offset = stream->position + offset; - whence = SEEK_SET; + ZEND_ASSERT(stream->position >= 0); + if (UNEXPECTED(offset > ZEND_LONG_MAX - stream->position)) { + offset = ZEND_LONG_MAX; + } else { + offset = stream->position + offset; + } + whence = SEEK_SET; break; } ret = stream->ops->seek(stream, offset, whence, &stream->position);