Merge branch 'PHP-8.3' into PHP-8.4

Author: devnexen

NEWS

@@ -41,6 +41,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
     (nielsdos)
 
+- Sockets:
+  . Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)
+
 - SPL:
   . Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos)
 

ext/sockets/sockets.c

@@ -1452,7 +1452,8 @@ PHP_FUNCTION(socket_recvfrom)
 
 	/* overflow check */
 	/* Shouldthrow ? */
-	if ((arg3 + 2) < 3) {
+
+	if (arg3 <= 0 || arg3 > ZEND_LONG_MAX - 1) {
 		RETURN_FALSE;
 	}
 

ext/sockets/tests/socket_recv_overflow.phpt

@@ -0,0 +1,19 @@
+--TEST--
+socket_recvfrom overflow on length argument
+--EXTENSIONS--
+sockets
+--SKIPIF--
+<?php
+if (strtolower(substr(PHP_OS, 0, 3)) === 'win') {
+    die('skip not valid for Windows.');
+}
+--FILE--
+<?php
+$s = socket_create(AF_UNIX, SOCK_DGRAM, 0);
+$buf = $end = "";
+var_dump(socket_recvfrom($s, $buf, PHP_INT_MAX, 0, $end));
+var_dump(socket_recvfrom($s, $buf, -1, 0, $end));
+?>
+--EXPECT--
+bool(false)
+bool(false)