From ba5ac0d360f0f2cab3ab5a478c601e4071acd0f2 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sun, 4 Sep 2016 22:18:19 -0700
Subject: [PATCH] Add more checks for int overflow

---
 ext/recode/recode.c | 24 ++++++++++++------------
 ext/standard/file.c |  4 ++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/ext/recode/recode.c b/ext/recode/recode.c
index 7d141e79281..cde03aacd1a 100644
--- a/ext/recode/recode.c
+++ b/ext/recode/recode.c
@@ -15,7 +15,7 @@
    | Author: Kristian Koehntopp <kris@koehntopp.de>					      |
    +----------------------------------------------------------------------+
  */
- 
+
 /* $Id$ */
 
 /* {{{ includes & prototypes */
@@ -62,7 +62,7 @@ ZEND_END_MODULE_GLOBALS(recode)
 #else
 # define ReSG(v) (recode_globals.v)
 #endif
-    
+
 ZEND_DECLARE_MODULE_GLOBALS(recode)
 static PHP_GINIT_FUNCTION(recode);
 
@@ -89,13 +89,13 @@ static const zend_function_entry php_recode_functions[] = {
 
 zend_module_entry recode_module_entry = {
 	STANDARD_MODULE_HEADER,
-	"recode", 
- 	php_recode_functions, 
-	PHP_MINIT(recode), 
-	PHP_MSHUTDOWN(recode), 
+	"recode",
+ 	php_recode_functions,
+	PHP_MINIT(recode),
+	PHP_MSHUTDOWN(recode),
 	NULL,
-	NULL, 
-	PHP_MINFO(recode), 
+	NULL,
+	PHP_MINFO(recode),
 	NO_VERSION_YET,
 	PHP_MODULE_GLOBALS(recode),
 	PHP_GINIT(recode),
@@ -164,14 +164,14 @@ PHP_FUNCTION(recode_string)
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Illegal recode request '%s'", req);
 		goto error_exit;
 	}
-	
+
 	recode_buffer_to_buffer(request, str, str_len, &r, &r_len, &r_alen);
 	if (!r) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Recoding failed.");
 error_exit:
 		RETVAL_FALSE;
 	} else {
-		RETVAL_STRINGL(r, r_len, 1);
+		RETVAL_STRINGL_CHECK(r, r_len, 1);
 		free(r);
 	}
 
@@ -202,7 +202,7 @@ PHP_FUNCTION(recode_file)
 	if (FAILURE == php_stream_cast(instream, PHP_STREAM_AS_STDIO, (void**)&in_fp, REPORT_ERRORS))	{
 		RETURN_FALSE;
 	}
-	
+
 	if (FAILURE == php_stream_cast(outstream, PHP_STREAM_AS_STDIO, (void**)&out_fp, REPORT_ERRORS))	{
 		RETURN_FALSE;
 	}
@@ -217,7 +217,7 @@ PHP_FUNCTION(recode_file)
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Illegal recode request '%s'", req);
 		goto error_exit;
 	}
-	
+
 	if (!recode_file_to_file(request, in_fp, out_fp)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Recoding failed.");
 		goto error_exit;
diff --git a/ext/standard/file.c b/ext/standard/file.c
index f3b6df12748..440276ab6e9 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1040,7 +1040,7 @@ PHPAPI PHP_FUNCTION(fgets)
 		}
 	}
 
-	ZVAL_STRINGL(return_value, buf, line_len, 0);
+	RETVAL_STRINGL_CHECK(buf, line_len, 0);
 	/* resize buffer if it's much larger than the result.
 	 * Only needed if the user requested a buffer size. */
 	if (argc > 1 && Z_STRLEN_P(return_value) < len / 2) {
@@ -1124,7 +1124,7 @@ PHPAPI PHP_FUNCTION(fgetss)
 
 	retval_len = php_strip_tags(retval, actual_len, &stream->fgetss_state, allowed_tags, allowed_tags_len);
 
-	RETURN_STRINGL(retval, retval_len, 0);
+	RETVAL_STRINGL_CHECK(retval, retval_len, 0);
 }
 /* }}} */