Merge branch 'PHP-8.4'

php · Jan 14, 2025 · a4e2583 · a4e2583
2 parents e95b298 + b1e0176
commit a4e2583
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
@@ -2686,6 +2686,12 @@ PHP_METHOD(SplFileObject, ftruncate)
 
 	CHECK_SPL_FILE_OBJECT_IS_INITIALIZED(intern);
 
+	if (size < 0) {
+		zend_argument_value_error(1, "must be greater than or equal to 0");
+		RETURN_THROWS();
+	}
+
+
 	if (!php_stream_truncate_supported(intern->u.file.stream)) {
 		zend_throw_exception_ex(spl_ce_LogicException, 0, "Can't truncate file %s", ZSTR_VAL(intern->file_name));
 		RETURN_THROWS();

diff --git a/ext/spl/tests/gh17463.phpt b/ext/spl/tests/gh17463.phpt
@@ -0,0 +1,16 @@
+--TEST--
+GH-17463 segfault on SplFileObject::ftruncate() with negative value.
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+$cls = new SplTempFileObject();
+
+try {
+	$cls->ftruncate(-1);
+} catch (\ValueError $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+SplFileObject::ftruncate(): Argument #1 ($size) must be greater than or equal to 0