Skip to content

Commit d01bc9a

Browse files
committed
Merge branch 'PHP-8.5'
* PHP-8.5: ext/sockets: socket_sendto() add max addr length control for AF_UNIX.
2 parents 49f903c + 15163de commit d01bc9a

2 files changed

Lines changed: 35 additions & 0 deletions

File tree

ext/sockets/sockets.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1725,6 +1725,12 @@ PHP_FUNCTION(socket_sendto)
17251725
switch (php_sock->type) {
17261726
case AF_UNIX:
17271727
memset(&s_un, 0, sizeof(s_un));
1728+
1729+
if (addr_len >= sizeof(s_un.sun_path)) {
1730+
zend_argument_value_error(5, "must be less than %d", sizeof(s_un.sun_path));
1731+
RETURN_THROWS();
1732+
}
1733+
17281734
s_un.sun_family = AF_UNIX;
17291735
snprintf(s_un.sun_path, sizeof(s_un.sun_path), "%s", ZSTR_VAL(addr));
17301736

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
--TEST--
2+
socket_sendto() with AF_UNIX rejects address exceeding sun_path limit
3+
--EXTENSIONS--
4+
sockets
5+
--SKIPIF--
6+
<?php
7+
if (substr(PHP_OS, 0, 3) == 'WIN') {
8+
die('skip not valid for Windows');
9+
}
10+
?>
11+
--FILE--
12+
<?php
13+
$socket = socket_create(AF_UNIX, SOCK_DGRAM, 0);
14+
if (!$socket) {
15+
die('Unable to create AF_UNIX socket');
16+
}
17+
18+
$long_addr = str_repeat('a', 512);
19+
20+
try {
21+
socket_sendto($socket, "data", 4, 0, $long_addr);
22+
} catch (\ValueError $e) {
23+
echo $e->getMessage() . PHP_EOL;
24+
}
25+
26+
socket_close($socket);
27+
?>
28+
--EXPECTF--
29+
socket_sendto(): Argument #5 ($address) must be less than %d

0 commit comments

Comments
 (0)