fsockopen()/stream_socket_client() accept TCP ports above 65535, which wrap to another port
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- backend, networking
Research direction
Start by reading parse_ip_address_ex() in main/streams/xp_socket.c, especially the atoi() calls noted in the issue, and check how socket ports are validated elsewhere, including parse_url(). Add a regression test for stream_socket_client() and fsockopen() with a port above 65535. Done means both reject the invalid port instead of connecting to the wrapped port.
Written by the indexing model from the issue text.
Description
Description
A TCP port number above 65535 is not rejected by fsockopen() or stream_socket_client(): it wraps modulo 65536 and the connection goes to a different port. parse_ip_address_ex() in main/streams/xp_socket.c reads the port with atoi() and stores it without a range check.
The following code:
<?php
$srv = stream_socket_server("tcp://127.0.0.1:0");
$name = stream_socket_get_name($srv, false);
$port = (int)substr($name, strrpos($name, ':') + 1);
$c = stream_socket_client("tcp://127.0.0.1:" . ($port + 65536));
echo "asked for ", $port + 65536, ", connected to ", stream_socket_get_name($c, true), "\n";
$c2 = fsockopen("127.0.0.1", $port + 65536);
echo "fsockopen connected to ", stream_socket_get_name($c2, true), "\n";
Resulted in this output:
asked for 99735, connected to 127.0.0.1:34199
fsockopen connected to 127.0.0.1:34199
But I expected this output instead: both calls fail with an invalid port error, since 99735 is not a valid TCP port (parse_url() already rejects such ports).
Reproduced on 8.2.34-dev (512c04e39f) and 8.4.28-dev; master has the same atoi() calls (xp_socket.c lines 654 and 664).
This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.
PHP Version
PHP 8.4.28-dev, PHP 8.2.34-dev
Operating System
Linux (Ubuntu 20.04, x86_64)
- Dominant language
- C
- Stars
- 40.7k
- Forks
- 8.3k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 155
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from php/php-src
-
Case-insensitive substr_compare, ksort, krsort are still locale-dependentPossibly taken A pull request linked to this issue is open or already merged. OpenBug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
php/php-src#24552 · 1 comment ·
Maintainers usually reply within 1 day
-
HTTP wrapper leaks Location buffer when an empty Location header is followed by another Location headerPossibly taken @bercedev claimed this 2 days ago. OpenBug Category: Streams Status: Verified
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
`Time\Duration::__unserialize()` accepts a "negative zero" payload.Possibly taken @TimWolla claimed this today. OpenBug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 71/100
php/php-src#24505 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
master: part of the mbstring bailout fix got lost in a mergePossibly taken @lazerg claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day
Similar issues
-
category:port-update
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 2 days
-
emerge failure MARK mark-unstable media-kit
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
macaroni-os/mark-issues#834 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
NVIDIA/open-gpu-kernel-modules#1479 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 1/5 Under an hour Newbie friendliness 93/100
webarkit/WebARKitLib#107 ·
Maintainers usually reply within 1 day