From 267aea00e80c12fb4bedb10367f58dede3d72e25 Mon Sep 17 00:00:00 2001
From: Sjoerd Langkemper <sjoerd-github@linuxonly.nl>
Date: Thu, 16 Jul 2026 08:28:26 +0000
Subject: [PATCH] error when curl read func returns unexpected long

Raise a value error when the callback registered with
CURLOPT_READFUNCTION returns an unexpected long.

The function registered with CURLOPT_READFUNCTION should return a
string. PHP then writes that string to a buffer and returns the
length, so that curl can read that many bytes from the buffer.

The function can also return CURL_READFUNC_ABORT and
CURL_READFUNC_PAUSE, so it also supports returning longs. However, when
it returns a long other than these two constants, it is interpreted as a
length. PHP does not update the buffer, but does instruct curl it can
read that many bytes from the buffer. It reads whatever uninitialized
data that is in the buffer and sends it over the line to the server.

This seems bad, so validate the return value of the read function and
raise an error.

Returning 0 is a bit of an edge case. It is not documented but does
results in correct behavior (i.e. end-of-file). So we accept that, but
don't advertise it as valid in the error message.

I am not worried about BC-break, because sending an uninitialized buffer
does not result in a valid request, so this would already not work.

I considered silently casting the int to a string. This would be very
"old PHP" behavior. I think throwing an error is more strict and better
and more in line with "new PHP" behavior, if that makes sense.

Related to https://github.com/php/php-src/issues/10270
---
 ext/curl/interface.c                          | 11 +++++++
 .../curl_read_function_error_on_int.phpt      | 30 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 ext/curl/tests/curl_read_function_error_on_int.phpt

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index c0286069776e..c3001696483a 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -820,6 +820,17 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 					memcpy(data, Z_STRVAL(retval), length);
 				} else if (Z_TYPE(retval) == IS_LONG) {
 					length = Z_LVAL_P(&retval);
+
+					switch (length) {
+						// Acceptable long values:
+						case 0:
+						case CURL_READFUNC_ABORT:
+						case CURL_READFUNC_PAUSE:
+							break;
+						default:
+							zend_value_error("The CURLOPT_READFUNCTION callback must return a string or CURL_READFUNC_ABORT or CURL_READFUNC_PAUSE");
+							length = CURL_READFUNC_ABORT;
+					}
 				}
 				// TODO Do type error if invalid type?
 				zval_ptr_dtor(&retval);
diff --git a/ext/curl/tests/curl_read_function_error_on_int.phpt b/ext/curl/tests/curl_read_function_error_on_int.phpt
new file mode 100644
index 000000000000..30ba97737727
--- /dev/null
+++ b/ext/curl/tests/curl_read_function_error_on_int.phpt
@@ -0,0 +1,30 @@
+--TEST--
+error when CURLOPT_READFUNCTION returns an integer
+--EXTENSIONS--
+curl
+--FILE--
+<?php
+function custom_readfunction($oCurl, $hReadHandle, $iMaxOut)
+{
+    static $size = 2;
+    return $size--;
+}
+
+include 'server.inc';
+$host = curl_cli_server_start();
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_URL, "{$host}/get.php?test=post");
+curl_setopt($ch, CURLOPT_POST, ['f' => 'f']);
+curl_setopt($ch, CURLOPT_TIMEOUT, 2);
+curl_setopt($ch, CURLOPT_READFUNCTION, "custom_readfunction" );
+
+try {
+    curl_exec($ch);
+} catch (ValueError $e) {
+    echo $e->getMessage() . "\n";
+}
+var_dump(curl_error($ch));
+?>
+--EXPECT--
+The CURLOPT_READFUNCTION callback must return a string or CURL_READFUNC_ABORT or CURL_READFUNC_PAUSE
+string(29) "operation aborted by callback"