diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c index f1a62c719291a..2430b10977ec7 100644 --- a/ext/sockets/sockets.c +++ b/ext/sockets/sockets.c @@ -1402,7 +1402,8 @@ PHP_FUNCTION(socket_recvfrom) /* overflow check */ /* Shouldthrow ? */ - if ((arg3 + 2) < 3) { + + if (arg3 <= 0 || arg3 > ZEND_LONG_MAX - 1) { RETURN_FALSE; } diff --git a/ext/sockets/tests/socket_recv_overflow.phpt b/ext/sockets/tests/socket_recv_overflow.phpt new file mode 100644 index 0000000000000..9b3f7a0bbb538 --- /dev/null +++ b/ext/sockets/tests/socket_recv_overflow.phpt @@ -0,0 +1,19 @@ +--TEST-- +socket_recvfrom overflow on length argument +--EXTENSIONS-- +sockets +--SKIPIF-- + +--EXPECT-- +bool(false) +bool(false)