From 5a024d2c5b17238a588bb14b6a2cdf8012a59068 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Fri, 11 Oct 2019 13:36:16 +0200
Subject: [PATCH] Fix #78662: stream_write bad error detection

---
 ext/standard/tests/streams/bug78662.phpt | 32 ++++++++++++++++++++++++
 main/streams/userspace.c                 | 15 +++++------
 2 files changed, 40 insertions(+), 7 deletions(-)
 create mode 100644 ext/standard/tests/streams/bug78662.phpt

diff --git a/ext/standard/tests/streams/bug78662.phpt b/ext/standard/tests/streams/bug78662.phpt
new file mode 100644
index 00000000000..e874d5aef68
--- /dev/null
+++ b/ext/standard/tests/streams/bug78662.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #78662 (stream_write bad error detection)
+--FILE--
+<?php
+class FailedStream {
+    function stream_open($path, $mode, $options, &$opened_path)
+    {
+        return true;
+    }
+    function stream_read($count)
+    {
+        return false;
+    }
+    function stream_write($data)
+    {
+        return false;
+    }
+    function stream_stat()
+    {
+        return [];
+    }
+}
+stream_wrapper_register('fails', 'FailedStream');
+$f=fopen('fails://foo', 'a+');
+var_dump(fwrite($f, "bar"));
+var_dump(fread($f, 100));
+?>
+Done
+--EXPECTF--
+bool(false)
+bool(false)
+Done
diff --git a/main/streams/userspace.c b/main/streams/userspace.c
index 91fd83954c1..9cf1580a352 100644
--- a/main/streams/userspace.c
+++ b/main/streams/userspace.c
@@ -630,7 +630,7 @@ static ssize_t php_userstreamop_write(php_stream *stream, const char *buf, size_
 	}
 
 	/* don't allow strange buffer overruns due to bogus return */
-	if (didwrite > count) {
+	if (didwrite > 0 && didwrite > count) {
 		php_error_docref(NULL, E_WARNING, "%s::" USERSTREAM_WRITE " wrote " ZEND_LONG_FMT " bytes more data than requested (" ZEND_LONG_FMT " written, " ZEND_LONG_FMT " max)",
 				us->wrapper->classname,
 				(zend_long)(didwrite - count), (zend_long)didwrite, (zend_long)count);
@@ -686,13 +686,14 @@ static ssize_t php_userstreamop_read(php_stream *stream, char *buf, size_t count
 	}
 
 	didread = Z_STRLEN(retval);
-	if (didread > count) {
-		php_error_docref(NULL, E_WARNING, "%s::" USERSTREAM_READ " - read " ZEND_LONG_FMT " bytes more data than requested (" ZEND_LONG_FMT " read, " ZEND_LONG_FMT " max) - excess data will be lost",
-				us->wrapper->classname, (zend_long)(didread - count), (zend_long)didread, (zend_long)count);
-		didread = count;
-	}
-	if (didread > 0)
+	if (didread > 0) {
+		if (didread > count) {
+			php_error_docref(NULL, E_WARNING, "%s::" USERSTREAM_READ " - read " ZEND_LONG_FMT " bytes more data than requested (" ZEND_LONG_FMT " read, " ZEND_LONG_FMT " max) - excess data will be lost",
+					us->wrapper->classname, (zend_long)(didread - count), (zend_long)didread, (zend_long)count);
+			didread = count;
+		}
 		memcpy(buf, Z_STRVAL(retval), didread);
+	}
 
 	zval_ptr_dtor(&retval);
 	ZVAL_UNDEF(&retval);