diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c index 5f0127e94f21..79d5f77856d5 100644 --- a/ext/sockets/sockets.c +++ b/ext/sockets/sockets.c @@ -1584,6 +1584,12 @@ PHP_FUNCTION(socket_sendto) switch (php_sock->type) { case AF_UNIX: memset(&s_un, 0, sizeof(s_un)); + + if (addr_len >= sizeof(s_un.sun_path)) { + zend_argument_value_error(5, "must be less than %d", sizeof(s_un.sun_path)); + RETURN_THROWS(); + } + s_un.sun_family = AF_UNIX; snprintf(s_un.sun_path, sizeof(s_un.sun_path), "%s", addr); diff --git a/ext/sockets/tests/socket_sendto_unix_addr_too_long.phpt b/ext/sockets/tests/socket_sendto_unix_addr_too_long.phpt new file mode 100644 index 000000000000..f2b62527e337 --- /dev/null +++ b/ext/sockets/tests/socket_sendto_unix_addr_too_long.phpt @@ -0,0 +1,29 @@ +--TEST-- +socket_sendto() with AF_UNIX rejects address exceeding sun_path limit +--EXTENSIONS-- +sockets +--SKIPIF-- + +--FILE-- +getMessage() . PHP_EOL; +} + +socket_close($socket); +?> +--EXPECTF-- +socket_sendto(): Argument #5 ($address) must be less than %d