Fix main/streams

The php://memory seek handler negated the zend_off_t offset as size_t,
which truncates where size_t is narrower, so a seek by PHP_INT_MIN or
beyond 4GB succeeded at a wrapped position. Negate it as zend_ulong
instead, and fail seeks whose target does not fit size_t.

Author: marc-mabe

ext/standard/tests/streams/php_memory_seek_offset_sizet.phpt

@@ -0,0 +1,81 @@
+--TEST--
+fseek() on php://memory with offsets beyond size_t on narrow size_t
+--SKIPIF--
+<?php
+if (PHP_SYS_SIZE >= PHP_INT_SIZE) {
+    die("skip size_t is not narrower than zend_long on this platform");
+}
+?>
+--FILE--
+<?php
+$sizeMax = 2 ** (PHP_SYS_SIZE * 8) - 1;
+
+foreach (['php://memory', 'php://temp'] as $url) {
+    echo "$url\n";
+    $s = fopen($url, 'r+');
+    fwrite($s, 'hello');
+
+    foreach ([
+        'SET SIZE_MAX + 1' => [$sizeMax + 1, SEEK_SET],
+        'SET SIZE_MAX + 3' => [$sizeMax + 3, SEEK_SET],
+        'SET PHP_INT_MAX' => [PHP_INT_MAX, SEEK_SET],
+        'CUR SIZE_MAX' => [$sizeMax, SEEK_CUR],
+        'CUR PHP_INT_MAX' => [PHP_INT_MAX, SEEK_CUR],
+        'CUR -(SIZE_MAX + 1)' => [-($sizeMax + 1), SEEK_CUR],
+        'CUR PHP_INT_MIN' => [PHP_INT_MIN, SEEK_CUR],
+        'END SIZE_MAX' => [$sizeMax, SEEK_END],
+        'END -(SIZE_MAX + 1)' => [-($sizeMax + 1), SEEK_END],
+        'END PHP_INT_MIN' => [PHP_INT_MIN, SEEK_END],
+    ] as $label => [$offset, $whence]) {
+        fseek($s, 1);
+        printf("%-20s %2d %d\n", $label, fseek($s, $offset, $whence), ftell($s));
+    }
+
+    echo "Up to SIZE_MAX\n";
+    var_dump(fseek($s, $sizeMax, SEEK_SET));
+    var_dump(ftell($s) === $sizeMax);
+    var_dump(fseek($s, 1, SEEK_CUR));
+    var_dump(ftell($s) === $sizeMax);
+    var_dump(fseek($s, $sizeMax - 5, SEEK_END));
+    var_dump(ftell($s) === $sizeMax);
+
+    fclose($s);
+}
+?>
+--EXPECT--
+php://memory
+SET SIZE_MAX + 1     -1 1
+SET SIZE_MAX + 3     -1 1
+SET PHP_INT_MAX      -1 1
+CUR SIZE_MAX         -1 1
+CUR PHP_INT_MAX      -1 1
+CUR -(SIZE_MAX + 1)  -1 1
+CUR PHP_INT_MIN      -1 1
+END SIZE_MAX         -1 1
+END -(SIZE_MAX + 1)  -1 1
+END PHP_INT_MIN      -1 1
+Up to SIZE_MAX
+int(0)
+bool(true)
+int(-1)
+bool(true)
+int(0)
+bool(true)
+php://temp
+SET SIZE_MAX + 1     -1 1
+SET SIZE_MAX + 3     -1 1
+SET PHP_INT_MAX      -1 1
+CUR SIZE_MAX         -1 1
+CUR PHP_INT_MAX      -1 1
+CUR -(SIZE_MAX + 1)  -1 1
+CUR PHP_INT_MIN      -1 1
+END SIZE_MAX         -1 1
+END -(SIZE_MAX + 1)  -1 1
+END PHP_INT_MIN      -1 1
+Up to SIZE_MAX
+int(0)
+bool(true)
+int(-1)
+bool(true)
+int(0)
+bool(true)

main/streams/memory.c

@@ -126,7 +126,7 @@ static int php_stream_memory_seek(php_stream *stream, zend_off_t offset, int whe
 	switch(whence) {
 		case SEEK_CUR:
 			if (offset < 0) {
-				if (ms->fpos < -(size_t)offset) {
+				if (ms->fpos < -(zend_ulong)offset) {
 					*newoffs = ms->fpos;
 					return -1;
 				} else {
@@ -136,6 +136,9 @@ static int php_stream_memory_seek(php_stream *stream, zend_off_t offset, int whe
 					stream->fatal_error = 0;
 					return 0;
 				}
+			} else if ((zend_ulong)offset > SIZE_MAX - ms->fpos) {
+				*newoffs = ms->fpos;
+				return -1;
 			} else {
 				stream->eof = 0;
 				stream->fatal_error = 0;
@@ -144,7 +147,7 @@ static int php_stream_memory_seek(php_stream *stream, zend_off_t offset, int whe
 				return 0;
 			}
 		case SEEK_SET:
-			if (offset < 0) {
+			if (offset < 0 || ZEND_LONG_SIZE_T_OVFL(offset)) {
 				*newoffs = ms->fpos;
 				return -1;
 			} else {
@@ -156,12 +159,16 @@ static int php_stream_memory_seek(php_stream *stream, zend_off_t offset, int whe
 			}
 		case SEEK_END:
 			if (offset > 0) {
+				if ((zend_ulong)offset > SIZE_MAX - ZSTR_LEN(ms->data)) {
+					*newoffs = ms->fpos;
+					return -1;
+				}
 				ms->fpos = ZSTR_LEN(ms->data) + offset;
 				*newoffs = ms->fpos;
 				stream->eof = 0;
 				stream->fatal_error = 0;
 				return 0;
-			} else if (ZSTR_LEN(ms->data) < -(size_t)offset) {
+			} else if (ZSTR_LEN(ms->data) < -(zend_ulong)offset) {
 				*newoffs = ms->fpos;
 				return -1;
 			} else {